⌘K
Change language Switch ThemeSign In
Narrow Mode
Critical Supply Chain Attack on Axios: Security Best Practices
Critical Supply Chain Attack on Axios: Security Best Practices
 ### Gergely Orosz@GergelyOrosz
Supply chain attacks are becoming more frequent, and far more serious.
What are sensible practices to protect against these when using Node or Python packages?
I assume pinning versions is the bare minimum; for those with security teams / tools: why else do you do / can you do?
#### Feross
@feross · 5h ago
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.Show More
285
2,477
9,010
3.8M
Mar 31, 2026, 6:53 AM View on X
25 Replies
9 Retweets
136 Likes
15.5K Views  Gergely Orosz @GergelyOrosz
One Sentence Summary
Gergely Orosz highlights a critical supply chain attack on the axios npm package and initiates a discussion on robust security practices for dependency management.
Summary
This tweet addresses a critical security incident involving the axios npm package, which has been compromised by a supply chain attack involving the malicious 'plain-crypto-js' package. Referencing a detailed security report, Gergely Orosz prompts the engineering community to move beyond basic version pinning and discuss more robust security practices for managing Node and Python package dependencies to mitigate similar risks.
AI Score
83
Influence Score 34
Published At Today
Language
English
Tags
Supply Chain Attack
Axios
Security
Software Engineering
Dependency Management HomeArticlesPodcastsVideosTweets