Listen to this Post
Introduction:
A critical supply chain attack is actively targeting the `axios` library, one of the most popular JavaScript HTTP clients with over 100 million weekly downloads. Attackers have injected malicious code into version 1.14.1, which may execute arbitrary code on any system that ran `npm install` in the past several hours. This incident highlights the growing danger of dependency confusion and compromised open-source packages, demanding immediate incident response across all development and production environments.
Learning Objectives:
- Identify compromised `axios` version `1.14.1` and the presence of the malicious `plain-crypto-js` package in your
node_modules. - Execute immediate mitigation steps, including pinning to a safe version and initiating incident response procedures.
- Implement long-term supply chain security hardening using package lock integrity, dependency scanning, and CI/CD controls.
You Should Know:
- Detecting the Axios Compromise: Commands and Indicators of Compromise (IoCs)
Start by verifying whether your project has been exposed. The malicious version `[email protected]` downloads an additional package `plain-crypto-js` that contains the payload. Run these commands on Linux, macOS, or Windows (using PowerShell or CMD with Node.js installed):
Check which axios version is resolved in your project npm list axios List all installed packages and grep for the malicious indicator ls node_modules | grep plain-crypto-js Linux/macOS dir node_modules | findstr plain-crypto-js Windows (CMD) Get-ChildItem node_modules -Name | Select-String plain-crypto-js PowerShell
What these commands do:
`npm list axios` displays the dependency tree showing the exact version of axios your project uses, including any nested dependencies.
`ls` or `dir` enumerates the `node_modules` folder; grep/findstr filters for the malicious package name. A match confirms your environment executed the malicious code.
Step‑by‑step guide to scan all projects:
- For each repository, navigate to its root directory containing
package.json. - Run `npm list axios –depth=0` to quickly see the top-level axios version.
3. Recursively search for `plain-crypto-js` across all projects:
`find ~/projects -name “node_modules” -exec ls {}/ \; | grep plain-crypto-js` (Linux/macOS).
4. On Windows (PowerShell): Get-ChildItem -Path C:\projects -Filter node_modules -Recurse -Directory | ForEach-Object { Get-ChildItem $_.FullName | Where-Object Name -eq plain-crypto-js }.
5. If found, assume the host is compromised – disconnect from network and begin forensic collection.
- Emergency Mitigation: Pinning to a Safe Version and Isolating Systems
Do not run `npm install` without pinning. The safe version currently known is 1.13.6. Immediately update your `package.json` and reinstall.
Step‑by‑step guide for mitigation:
- Pin axios to the safe version in
package.json:"dependencies": { "axios": "1.13.6" }Use exact version (no `^` or `~` prefix) to prevent automatic upgrades.
2. Delete existing node_modules and package-lock.json (or yarn.lock):
rm -rf node_modules package-lock.json Linux/macOS rmdir /s node_modules && del package-lock.json Windows CMD Remove-Item -Recurse -Force node_modules, package-lock.json PowerShell
3. Reinstall dependencies with the pinned version:
npm install
- Verify the installation – ensure axios version is `1.13.6` and `plain-crypto-js` is absent:
npm list axios ls node_modules | grep plain-crypto-js should return nothing
-
If you already ran npm install with the compromised version, initiate incident response:
– Revoke all secrets, tokens, and environment variables stored on that machine.
– Scan for outbound connections to unknown IPs (use `netstat -an` or lsof -i).
– Check for new cron jobs, scheduled tasks, or persistence mechanisms.
– Assume any build artifacts, containers, or production servers that received code from that machine are also compromised.
- Hardening Your Supply Chain: Integrity Verification and Automated Prevention
Beyond immediate patching, implement these controls to defend against future npm supply chain attacks.
Using npm’s built-in integrity checks (package-lock.json with `integrity` hashes):
`package-lock.json` stores SHA-512 hashes of each package. After pinning, commit this file. Before any install, run:
npm ci instead of npm install – enforces lockfile and fails if hashes mismatch
This prevents installation of tampered packages even if the registry serves a malicious version.
Enabling dependency scanning in CI/CD:
Add a pre-install step that blocks known malicious versions. Example using `npm audit` and a custom script:
GitHub Actions example - name: Check axios version run: | VERSION=$(npm list axios --depth=0 | grep axios@ | cut -d@ -f2) if [ "$VERSION" = "1.14.1" ]; then echo "::error::Compromised axios version detected" exit 1 fi
Using Snyk or OWASP Dependency-Check:
- Snyk CLI: `snyk test` – detects malicious packages and vulnerable dependencies.
- OWASP Dependency-Check: `dependency-check –scan ./ –format HTML` – generates a report of known CVEs and suspicious components.
Windows-specific hardening with PowerShell and AppLocker:
Restrict execution of unknown scripts from `node_modules/.bin` by configuring AppLocker rules or using constrained language mode. Example PowerShell to block suspicious binaries:
$malicious = "plain-crypto-js"
if (Test-Path "node_modules\$malicious") {
Write-Error "Malicious package detected! Stopping build."
exit 1
}
4. Incident Response Deep Dive: Post-Compromise Forensics
If you confirmed exposure, follow this IR checklist:
Collect volatile data first (before powering off):
- Running processes: `ps aux | grep node` (Linux) or `Get-Process node` (PowerShell).
- Network connections: `netstat -anp` (Linux) or `netstat -an` (Windows).
- Command history: `history` (Linux) or `Get-Content (Get-PSReadLineOption).HistorySavePath` (PowerShell).
Analyze the malicious payload:
The `plain-crypto-js` package is not a legitimate cryptography library; it’s a typosquat of crypto-js. Retrieve its entry point:
cat node_modules/plain-crypto-js/index.js Examine the code
Look for obfuscated eval, child_process.exec, or network requests to attacker-controlled domains.
Containment actions:
- Block outbound traffic to unknown IPs via firewall or security group rules.
- Rotate all secrets (AWS keys, database passwords, JWT secrets) that were present on the affected machine.
- Remove the malicious package and any spawned persistence: `npm remove plain-crypto-js` then delete `node_modules` entirely.
- Long-term Strategic Defenses: Private Registries and Dependency Pinning
Set up a private npm mirror (Verdaccio, JFrog Artifactory, or GitHub Packages):
– Proxy only approved package versions.
– Configure `npm config set registry https://your-private-registry.com`.
– Scan all incoming packages with antivirus and static analysis before caching.
Use dependency pinning with overrides (npm >=8.3):
In package.json, force every transitive dependency to a safe version:
"overrides": {
"axios": "1.13.6"
}
This ensures even deeply nested axios instances are overridden.
Automated updates with Dependabot or Renovate:
Configure these tools to block any axios update to version `1.14.1` using version rules. Example Dependabot config:
version: 2 updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "daily" ignore: - dependency-name: "axios" versions: ["1.14.1"]
6. Training and Certification Recommendations for Teams
To build resilience against supply chain attacks, invest in these training paths:
- SANS SEC540: Cloud Security and DevSecOps Automation – covers software supply chain security, including package signing and provenance.
- Certified Secure Software Lifecycle Professional (CSSLP) – focuses on integrating security into every phase of development.
- Node.js Security Workshop (OWASP) – hands-on labs for detecting malicious npm packages using
npm audit,socket.dev, and runtime protection. - Practical Supply Chain Attacks (Pluralsight course) – simulates real-world typosquatting, dependency confusion, and compromised build pipelines.
What Undercode Say:
- Never trust the npm registry blindly – even packages with 100 million downloads can be compromised. Always pin versions and verify integrity hashes.
- Automate detection in CI/CD – a simple grep for known IoCs (like
plain-crypto-js) or a version check could have stopped this attack before reaching production. - Supply chain attacks are the new zero‑days – organizations must treat `node_modules` as untrusted input, applying runtime constraints (e.g.,
--no-bin-links, sandboxed builds).
Prediction:
This axios incident will accelerate the adoption of software bills of materials (SBOMs) and package provenance tools (Sigstore, SLSA). Within 12 months, we expect npm to introduce mandatory two-factor authentication for maintainers of high-impact packages and real-time malware scanning on upload. However, attackers will shift to compromising build scripts or release automation, making runtime behavior analysis (e.g., using eBPF or sandboxed npm install) the next frontier in supply chain defense.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Https: – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
