Warning Issued: Malicious Axios Malware Targeting Developers

Blockchain security firm Slow Fog has alerted developers about two compromised versions of the axios library, which could expose them to malware. A malicious dependency, plain-crypto-js, installed through these axios releases, poses significant risks to crypto developers by running a remote access trojan on their systems.

Key Takeaways

Malicious Releases: Compromised versions of axios (v1.14.1 and v0.3.4) incorporated a harmful dependency, plain-crypto-js.
Security Risks: These versions could expose users to remote access trojans and stolen credentials.
Immediate Actions Recommended: Users should downgrade axios, audit their dependencies, and change any compromised credentials immediately.
Past Incidents: This incident echoes earlier npm malware campaigns that have targeted crypto users.

Axios npm malware attack on crypto developers

Main Content

Slow Fog, a blockchain security company, has issued a critical security alert regarding newly published axios versions (axios@1.14.1 and axios@0.3.4). These versions have included a malicious dependency known as plain-crypto-js@4.2.1. This development is concerning since axios is one of the most popular HTTP clients in JavaScript, with over 80 million weekly downloads through npm. A short-lived compromise can create widespread issues affecting wallet backends, trading bots, exchanges, and decentralized finance (DeFi) infrastructure built on Node.js.

In its advisory, Slow Fog cautioned that anyone who installed openclaw@2026.3.28 via the command npm install -g may be at risk. They suggested users should immediately rotate their credentials and thoroughly investigate their systems for signs of compromise.

The attack specifically relies on a deceptive cryptography package, plain-crypto-js@4.2.1. This package is added as a new dependency and executes a postinstall script designed to deliver a remote access trojan (RAT) that targets Windows, macOS, and Linux systems. According to StepSecurity, neither the malicious axios versions contain harmful code themselves; instead, they include a fake dependency solely aimed at running the harmful script.

StepSecurity elaborated that the malicious releases were facilitated using stolen npm credentials from the primary maintainer, “jasonsaayman,” allowing attackers to bypass the usual release processes on GitHub. “It’s an active supply chain compromise in axios@1.14.1, which newly relies on plain-crypto-js@4.2.1—a package published just hours earlier and identified as having malware that executes shell commands,” wrote security engineer Julian Harris on LinkedIn.

npm has since removed the malicious axios versions and reverted the affected library back to v1.14.0. However, any environment that accessed either version during the attack period remains vulnerable until secrets are rotated and systems are rebuilt.

This incident recalls previous npm attacks targeting crypto users. In a 2025 attack, for instance, 18 widely used packages like chalk and debug were manipulated to change wallet addresses, resulting in significant fund thefts. Ledger’s CTO, Charles Guillemet, warned at the time that these packages had been downloaded over 1 billion times. Furthermore, research has demonstrated that npm malware has stolen keys from wallets associated with Ethereum, XRP, and Solana. SlowMist has estimated that crypto hacks and fraudulent activities—including backdoored packages and AI-driven supply chain attacks—resulted in losses exceeding $2.3 billion in just the first half of 2025.

As a precautionary measure, Slow Fog strongly advises users to downgrade axios to version 1.14.0, thoroughly audit all dependencies for any presence of plain-crypto-js@4.2.1 or openclaw, and assume that any credentials accessed in those environments have likely been compromised.

In previous articles on JavaScript supply chain attacks, Guillemet highlighted the systemic risks posed by compromised npm packages that have accumulated over 2 billion weekly downloads. Additionally, it was noted how North Korea's Lazarus Group infiltrated developer environments using harmful npm packages aimed at Solana and Exodus wallet users. Further reports detailed how next-generation malware exploits through npm and affordable AI tools have allowed criminals to gain control of more than 4,200 developer machines, contributing to substantial financial losses within the crypto space.