Two malicious Axios npm releases have prompted warnings for developers to rotate credentials and treat affected systems as compromised after a supply chain attack poisoned the popular JavaScript HTTP client library.
The compromise was first reported by cybersecurity company Socket, which said axios@1.14.1 and axios@0.30.4 were modified to pull in plain-crypto-js@4.2.1, a malicious dependency that ran automatically during installation before the releases were removed from npm.
According to security company OX Security, the altered code can give attackers remote access to infected devices, allowing them to steal sensitive data such as login credentials, API keys and crypto wallet information.
The incident shows how a single compromised open-source component can potentially ripple across thousands of applications that rely on it, exposing not just developers but also platforms and users connected to the system.
Security companies urge key rotation, system audits
OX Security warned developers who installed axios@1.14.1 or axios@0.30.4 to treat their systems as fully compromised and immediately rotate credentials, including API keys and session tokens.
Socket said the compromised Axios releases were modified to include a dependency on plain-crypto-js@4.2.1, a package published shortly before the incident and later identified as malicious.
**Related: **__Trust Wallet browser extension knocked offline by Chrome Store ‘bug,’ CEO says
The company said the dependency was configured to run automatically during installation through a post-install script, allowing attackers to execute code on target systems without additional user interaction.
Socket advised developers to review their projects and dependency files for the affected Axios versions and the associated plain-crypto-js@4.2.1 package, and to remove or roll back any compromised versions immediately.
Earlier crypto incidents highlight supply chain risks
Earlier crypto incidents have shown how supply chain breaches can escalate from stolen developer information to user-facing wallet losses.
On Jan. 3, onchain investigator ZachXBT reported that “hundreds” of wallets across Ethereum Virtual Machine-compatible networks were drained in a broad attack that siphoned small amounts from each victim.
Cybersecurity researcher Vladimir S. said the incident was potentially linked to a December breach affecting Trust Wallet, which resulted in roughly $7 million in losses across over 2,500 wallets.
Trust Wallet later said the breach may have originated from a supply chain compromise involving npm packages used in its development workflow.
**Magazine: **__Nobody knows if quantum secure cryptography will even work
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently. Read our Editorial Policy
- #Blockchain
- #Security
- #Hackers
- #Cybersecurity
- #Hacks
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Seven Israeli Officers Charged in Multimillion-Dollar Crypto Theft Ring
Israeli Security Forces Charged in Crypto Theft Case
Israeli authorities have charged seven military and police officers with running a multimillion-dollar theft and bribery ring involving cryptocurrency, marking the second crypto-related criminal case to hit the country's defence establishment in
CryptoFrontier1h ago
Ice Open Network Suffers Data Breach; User Emails and 2FA Phone Numbers Exposed
Ice Open Network reported a security breach on April 15, revealing unauthorized access to user data, including email addresses and 2FA phone numbers, but no financial data was compromised. The incident, linked to former partners of a service provider, is under legal review, and users are advised to update security settings. The breach highlights escalating security issues in the crypto sector, with significant losses reported in recent months.
GateNews3h ago
Russian Crypto Exchange Grinex Halts Operations After $13M Hack, Threatening Sanctions Evasion Network
Russian cryptocurrency exchange Grinex ceased operations after a cyberattack caused losses over $13 million. The shutdown impacts Russian businesses' ability to convert rubles internationally and challenges the country's shadow finance system.
GateNews6h ago
Kelp DAO Hack Attributed to Lazarus Group; eth.limo Domain Hijacked via Social Engineering
LayerZero reported that the Kelp DAO exploit, attributed to North Korea's Lazarus Group, led to a loss of $292 million in rsETH tokens due to vulnerabilities in its decentralized verifier network. Additionally, eth.limo faced a domain hijacking from a social engineering attack, but DNSSEC mitigated severe damage.
GateNews10h ago
DeFi Hack Triggers $9 Billion in Outflows from Aave as Stolen Tokens Used as Collateral
A recent hack draining nearly $300 million from a crypto project led to a liquidity crisis on Aave, causing users to withdraw around $9 billion. Concerns over collateral quality prompted mass withdrawals, highlighting risks in DeFi lending.
GateNews10h ago
