the WORST hack of 2026

A high-profile supply-chain attack targeted Axios, one of the most widely used JavaScript HTTP libraries, by hijacking the lead maintainer’s account and slipping in a malicious dependency that triggers a remote access Trojan in roughly 1.1 seconds—then erases traces to make detection harder. With Axios seeing over 100 million downloads per week, the incident matters because it turns a routine “npm install” into a potential compromise path for countless applications that never directly install Axios themselves.

The attack’s core trick was account takeover plus a stealthy change to Axios’s dependency graph rather than an obvious backdoor in Axios source code. The attacker obtained a long-lived npm access token tied to the lead maintainer, then changed the maintainer account email and modified Axios’s package.json to reference a dependency named crypto.js. That dependency wasn’t imported anywhere in Axios’s 86 source files; it existed mainly to run an automatic postinstall script during installation. Instead of immediately publishing a malicious version, the attacker staged a clean version of the dependency about 18 hours earlier, then later swapped in the poisoned one—helping the change blend into normal review expectations.

To bypass typical safeguards, the attacker used npm CLI to push the altered releases while also poisoning specific release branches and versions: 1.14.1 and 0.30.4. Projects that install dependencies using a “caret” or compatible version range could pull the compromised package automatically, including during CI/CD runs or when other software depended on Axios indirectly. Socket.dev was among the first to identify the issue, and the poisoned releases spread quickly—within about 39 minutes of each other.

Once a vulnerable package was installed, the postinstall script acted as a dropper. It wrote a setup.js file that used layered obfuscation (including Base64 and additional encoding/transform steps) to hide malicious logic from static scanners. Setup.js then detected the victim’s operating system, contacted the attacker’s command-and-control (C2) server, downloaded the appropriate remote access Trojan, and executed it. After the payload was fetched and the system was effectively under attacker control, the script cleaned up by deleting setup.js, removing the malicious package.json, and restoring a pre-staged clean package.json—leaving minimal on-disk evidence.

The practical takeaway is that users may be infected without doing anything unusual: simply running npm install on affected versions could trigger the compromise. The guidance offered is to check installed Axios versions with npm list commands and, if needed, run deeper searches across a system for Axios 1.14.1 or 0.30.4. If indicators of the Trojan or C2 contact appear, the response should treat the machine as compromised—rotate API keys and other credentials/tokens rather than relying on file deletion alone. The incident is framed as an escalating pattern of supply-chain attacks, with remediation urgency proportional to how widely the dependency is used.