Supply Chain Compromise Impacts Axios Node Package Manager

Mon, 20 Apr 2026 23:48:11 +0000
Cybersecurity

CISA has issued an alert disclosing a supply chain compromise affecting Axios npm versions 1.14.1 and 0.30.4, which injected malicious dependency plain-crypto-js@4.2.1 that downloads a remote access trojan from threat actor infrastructure. The agency is urging all organizations using Axios npm to immediately downgrade to safe versions (axios@1.14.0 or axios@0.30.3), rotate exposed credentials, and implement recommended npm configuration settings. CISA advises monitoring CI/CD pipelines and developer machines for indicators of compromise, blocking connections to Sfrclak[.]com domains, and mandating phishing-resistant MFA on developer accounts.