{"id":60402,"date":"2026-03-31T10:29:10","date_gmt":"2026-03-31T10:29:10","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/supply-chain-blast-top-npm-package-backdoored-to-drop-dirty-rat-on-dev-machines\/"},"modified":"2026-03-31T10:29:10","modified_gmt":"2026-03-31T10:29:10","slug":"supply-chain-blast-top-npm-package-backdoored-to-drop-dirty-rat-on-dev-machines","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/supply-chain-blast-top-npm-package-backdoored-to-drop-dirty-rat-on-dev-machines\/","title":{"rendered":"Supply chain blast: Top npm package backdoored to drop dirty RAT on dev machines"},"content":{"rendered":"

One of npm’s most widely used HTTP client libraries briefly became a malware delivery vehicle after attackers hijacked a maintainer’s account and slipped a remote-access trojan (RAT) into two seemingly legitimate axios releases, in what’s being described<\/a> as “one of the most impactful npm supply chain attacks on record.”<\/p>\n

The poisoned versions, “axios@1.14.1” and “axios@0.30.4,” made it onto the npm registry before being yanked, though not before some unlucky devs and CI pipelines pulled them in. Rather than tampering with axios’s own code, the intruders took a subtler route, slipping in a dependency that had no business being there and no role in the library’s functionality.<\/p>\n

Axios is a widely used JavaScript HTTP client that developers rely on to send requests between applications and web services. It’s embedded in everything from front-end apps to back-end systems and racks up around 100 million downloads each week, meaning even a short-lived compromise can spread quickly.<\/p>\n