March 31, 2026/268 words/1 min read

Axios Got Hijacked and npm Already Knew

The axios hijack bypassed CI entirely.

Three days ago I wrote about dependency cooldowns. Today axios got hijacked. Good timing!

My min-release-age=3d config would have blocked both malicious versions (1.14.1 and 0.30.4) because they were less than three days old. npm yanked them within about three hours, long before my cooldown expired.

The attacker hijacked the primary maintainer's npm account and published the backdoored releases under the maintainer's real name. The fake dependency had a clean 4.2.0 release 18 hours earlier, while the malicious plain-crypto-js@4.2.1 landed only 22 minutes before axios@1.14.1. That staging might fool a scanner that only complains about brand-new package names. It did not beat a release-age gate because both axios versions were fresh, and so was the payload they pulled in.

Funny enough, the clearest signal was sitting in the registry the whole time. Every legitimate axios 1.x release is published via GitHub Actions with OIDC Trusted Publishers, and the metadata is public. You can compare it directly.

bash

npm view axios@1.14.0 _npmUser
# { name: 'GitHub Actions', email: 'npm-oidc-no-reply@github.com', trustedPublisher: { id: 'github', ... } }
 
npm view axios@1.14.1 _npmUser
# { name: 'jasonsaayman', email: 'ifstap@proton.me' }

The OIDC credentials are short-lived and tied to a specific workflow. This release bypassed CI entirely, and the registry recorded the maintainer account instead of a Trusted Publisher. That mismatch should make you stop before installing, but npm doesn't surface it in the standard workflow. You have to know which field to inspect.

npm has supported Trusted Publishers since July 2025. For packages that use one, a version without that binding is worth inspecting before you install it. I'll probably add this check to my dependency update process. npm should warn when a release breaks a package's trusted-publisher history, or at least show that history on the package page.

StepSecurity's full breakdown is worth reading.