Microsoft Details Steps to Mitigate the Axios npm Supply Chain Compromise

The recent cybersecurity incident involving the popular JavaScript library Axios highlights significant risks in software supply chains. Here are key points from Microsoft's guidance to mitigate this npm (Node Package Manager) supply chain compromise:

1. Affected Versions:

   • Roll back Axios deployments to version 0.30.3 or 1.14.0 immediately.

2. Credential Rotation:

   • Rotate any secrets or credentials exposed on compromised systems without delay.

3. Version Locking:

   • Remove caret (^) and tilde (~) prefixes from package.json files.
   • Pin Axios to an exact version number to prevent automatic upgrades.

4. Cache Cleaning:

   • Run npm cache clean --force to flush any cached malicious packages.

5. Audit Logs:

   • Review CI/CD logs for installs of affected Axios versions (0.21.1 and 0.27.2).
   • Check developer machines for the presence of the plain-crypto-js folder in node_modules.

6. Network Security:

   • Block outbound traffic to malicious domains/IPs:
     • Domain: sfrclak[.]com
     • IP Address:

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.