The axios hack, how one infected developer exposed 174,000 projects
Listen to the audio version
The article on APIs explained how an app talks to an outside service. Axios happens to be one of the most widely used tools in the world for doing exactly that in JavaScript, with about a hundred million downloads every week. On March 31, 2026, that tool briefly turned into spyware, for everyone who installed it during a three-hour window.
What happened
On March 31, 2026, attackers published two booby-trapped versions of axios (1.14.1 and 0.30.4) on npm, the main JavaScript software registry. These versions silently installed, through a hidden dependency named "plain-crypto-js" mimicking the name of an existing legitimate library, spyware able to run on Windows, macOS, and Linux. Security researcher Feross Aboukhadijeh raised the alarm publicly, and npm pulled the booby-trapped versions after about three hours of active distribution. With axios counting more than 174,000 projects directly depending on it, the potential scale of exposure, even over such a short window, remains considerable.
How the maintainer's own account got hacked
The root of this compromise carries a direct irony with the article on social engineering: axios's lead maintainer had his personal computer compromised first, by a targeted social engineering campaign, which itself installed spyware that harvested the credentials used to publish new versions of the software. Spyware, then, was used to distribute more spyware, at an entirely different scale: a single developer personally targeted was enough to open access to hundreds of thousands of projects that had, themselves, done absolutely nothing wrong.
The software supply chain mechanism, developer edition
Installing axios in a project takes just one simple command: development tools then automatically download the software along with every one of its own dependencies, with a developer not usually reviewing every line of code added this way. This is exactly the same supply-chain attack mechanism already seen with the Klue breach, applied this time not to a SaaS integration between companies, but directly to the open-source software ecosystem that nearly every modern app is built on.
Why three hours was enough for a massive impact
Most open-source software registries, npm included, let a new version of a project become instantly installable by anyone in the world the moment it's published, with no mandatory review delay. This speed, valuable for quickly fixing a genuine flaw, becomes a structural weakness the day a malicious version is the one being published: the community's reaction time then becomes the only real limit on how far it spreads.
What this actually changes
For a developer, this incident strengthens the case for precisely pinning the versions of dependencies used in a project rather than always pulling in the very latest version automatically, and for reviewing dependency updates rather than accepting them by reflex. For everyone else, it confirms that "trusted" software is never a guarantee frozen in time: that trust ultimately rests on the personal security of a sometimes small number of people who hold the publishing keys, a reminder that the software supply chain deserves the same vigilance as any other weak link already covered on this site.