Vulnerability Instance

Embedded Malicious Code via compromised maintainer account
Two malicious versions of the axios npm package (1.14.1 and 0.30.4) were published on March 31, 2026 using a compromised maintainer account. Both versions inject a hidden dependency (`plain-crypto-js@4.2.1`) that deploys a cross-platform remote access trojan targeting macOS, Windows, and Linux. The malicious `postinstall` script contacts a command-and-control server and downloads a platform-specific second-stage payload. Any system that ran `npm install` while either version was available should be treated as fully compromised. The malicious packages have been removed from the npm registry.