Axios NPM Supply Chain Compromise (March 2026) (4382681)

In March 2026, a software supply chain compromise was identified involving the widely used Axios JavaScript HTTP client published on the Node Package Manager (NPM) registry. Attackers gained unauthorized access to the Axios maintainer’s NPM publishing credentials and released malicious versions of the Axios package that delivered a cross-platform Remote Access Trojan (RAT) during installation.

Axios is one of the most commonly used JavaScript libraries for making HTTP requests and is embedded in web applications, backend services, CI/CD pipelines, and developer workstations across many industries. Due to its popularity and transitive use as a dependency, this compromise had the potential for broad downstream impact.

The issue is not a vulnerability in Axios source code itself and no CVE has been assigned. Instead, it is a release-path compromise, where trusted package distribution was abused to deliver malware.

One Identity has conducted a review to determine if we have any impact to our products. At this time no One Identity Software is impacted by this issue.