What happened: Microsoft says two malicious Axios releases (1.14.1 and 0.30.4) hit npm, with a dependency added purely to run install-time code and pull down a second-stage remote access trojan. Congrats: your “HTTP client” briefly doubled as a delivery vehicle.

Why it matters: The attacker doesn’t need to touch Axios’ runtime code — just your build pipeline. If you auto-update dependencies, the compromise can fire during install on developer machines and CI/CD, while your app still “works fine” (which is how you lose quietly).

Wider context: This is the modern supply chain playbook: poison something ubiquitous, hide in the boring parts (metadata, lifecycle scripts), and let scale do the rest. Open-source distribution is powerful — and so is the blast radius when someone gets a hand on the publish button.

Background: Microsoft attributes the infrastructure to “Sapphire Sleet” and describes OS-specific payload delivery for Windows, macOS, and Linux. The guidance: rotate secrets, downgrade to safe versions, and stop treating auto-updates like a security feature.

Mitigating the Axios npm supply chain compromise — Microsoft Security Blog

Singularity Soup Take: The “move fast” crowd accidentally reinvented remote code execution as a package manager feature — and then acted surprised when someone used it. If your builds are deterministic only in your dreams, your threat model is already out of date.

Key Takeaways:

• Install-Time Ambush: The malicious behavior was triggered via an added dependency and lifecycle script, meaning compromise can occur during npm install/update even if Axios’ actual application logic remains unchanged.
• Multi-OS Payloads: Microsoft describes a single command-and-control endpoint serving different second-stage RAT payloads depending on platform, targeting Windows, macOS, and Linux with distinct delivery mechanics.
• Immediate Mitigation: Microsoft advises anyone who installed Axios 1.14.1 or 0.30.4 to rotate secrets and credentials, downgrade to safe versions, and follow protective steps like disabling auto-updates for Axios packages.