(TLP:CLEAR) WaterISAC Notification – CISA Issues Cyber Alert ​​for Supply Chain Compromise Impacting Axios Node Package Manager​

Summary: Today, CISA sent a (TLP:CLEAR) Alert to provide guidance in response to the software supply chain compromise of the Axios node package manager (npm). Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments. WaterISAC is sharing this alert with its members out of an abundance of caution. As noted by SANS, “[Axios] is embedded in web applications, mobile apps, backend services, and automated build pipelines across virtually every industry.”

According to the CISA Alert, on March 31, 2026, two npm packages for versions [email protected] and [email protected] of Axios npm injected the malicious dependency [email protected] that downloads multi-stage payloads from cyber threat actor infrastructure, including a remote access trojan.

CISA urges organizations to implement the following recommendations to detect and remediate a potential compromise: 

• Monitor and review code repositories, continuous integration/continuous delivery (CI/CD) pipelines, and developer machines that ran npm install or npm update with the compromised Axios version.
  • Search for cached versions of affected dependencies in artifact repositories and dependency management tools. Pin npm package dependency versions to known safe releases.

If compromised dependencies are identified, revert the environment to a known safe state.

• Downgrade to [email protected] or [email protected] and delete node_modules/plain-crypto-js/.
• Rotate/revoke credentials that may have been exposed on affected systems or pipelines (e.g., version control system [VCS] tokens, CI/CD secrets, cloud keys, npm tokens, and Secure Shell [SSH] keys). For ephemeral CI jobs, rotate all secrets injected into the compromised run.
• Monitor for unexpected child processes and anomalous network behavior, specifically during npm install or npm update.
  • Block and monitor outbound connections to Sfrclak[.]com domains.
  • Conduct continuous indicator searches and endpoint detection and response (EDR) hunts to confirm no indicators of compromise (IOCs) remain; ensure no further egress to the command and control (C2).

In addition, CISA recommends organizations using Axios npm:

• Mandate phishing-resistant multifactor authentication (MFA) on all developer accounts, especially for critical platforms.
• Set ignore-scripts=true in the .npmrc configuration file, which prevents potentially malicious scripts from executing during npm install packages.
• Set min-release-age=7 .npmrc configuration file to only install packages that have been published for at least seven days, which helps avoid installation of packages that may not be completely vetted or are potentially malicious.
• Establish and maintain a baseline of normal execution behavior for tools that use Axios.
  • Alert when a dependency behaves differently (e.g., building containers, enabling shells, executing commands) and trace outbound network activity for anomalous connections.

Analyst Note: This activity highlights ongoing risk from software supply chain compromises, particularly for utilities relying on web applications, developer pipelines, or third-party integrations. The use of a trusted package to deliver a RAT underscores how developer environments and continuous integration/continuous delivery (CI/CD) pipelines can become initial access vectors.

See the following resources for additional guidance on this compromise:

• GitHub: Post Mortem: axios npm supply chain compromise #10636
• Microsoft: Mitigating the Axios npm supply chain compromise
• StepSecurity: axios Compromised on npm – Malicious Versions Drop Remote Access Trojan
• npm Docs: Securing your code
• Socket: Supply Chain Attack on Axios Pulls Malicious Dependency from npm

Original Source: https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager

Additional Reading:

• Axios NPM Supply Chain Compromise: Malicious Packages Deliver Remote Access Trojan

Related WaterISAC PIR: 6