NVISO Blog Post: Axios NPM Package Compromised in Supply Chain Attack
Published on February 28, 2025
Overview
The popular JavaScript library Axios was compromised by a threat actor who uploaded malicious versions of the package to the npm registry. This supply chain attack has led to the deployment of remote access trojans (RATs) in affected environments.
Incident Details
Timeline:
- February 20, 2025: Initial detection and reporting by security researchers.
- February 21, 2025: Malicious versions identified and removed from npm registry.
- February 23, 2025: Full analysis completed, including identification of C2 infrastructure.
Threat Actor: The attack is attributed to a North Korean threat actor group known for targeting software supply chains. The malicious packages were uploaded under the guise of legitimate updates but contained backdoor code that allowed remote control over infected systems.
Impact
- Compromised Packages: Malicious versions of Axios (0.30.4 and 1.14.1) were pushed to npm.
- **C2 Infrastructure
Read the full article at NVISO Labs
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.





