- Two compromised axios npm releases pulled in a malicious dependency that could steal credentials, API keys and crypto wallet data from developers.
- Security firms urge anyone using the affected axios versions to treat systems as compromised, rotate all keys and remove the malicious packages.
A recent compromise of the popular JavaScript HTTP client library axios has sparked fresh concern in the crypto ecosystem over software supply chain risks. Two malicious Axios npm releases were used to deploy code capable of harvesting sensitive data, including crypto wallet information, underscoring how vulnerabilities in widely used developer tools can cascade into losses for digital asset users and platforms.
Malicious Axios npm releases target crypto-related credentials
Cybersecurity firm Socket first reported that axios@1.14.1 and axios@0.30.4 on npm had been tampered with. The altered packages were configured to pull in plain-crypto-js@4.2.1, a dependency later identified as malicious. Crucially, the dependency executed automatically during installation via a post-install script, enabling attackers to run code on developer systems without further input.
Security company OX Security analyzed the modified Axios code and warned that it could grant remote access to compromised devices. Once inside, attackers were positioned to capture a wide range of sensitive data, including login credentials, API keys and crypto wallet details. For any developer or platform interacting with digital assets, the exposure of such information can directly translate into on-chain theft and unauthorized transfers.
Although the malicious Axios versions were eventually removed from npm, the period they were live was long enough to raise concerns that a significant number of projects may have integrated them. Because Axios is widely used across web applications, the blast radius of this compromise potentially reaches into crypto exchanges, DeFi front-ends, wallets and any service that relies on JavaScript stacks built with npm.
Security guidance and remediation steps for Axios users
In response, OX Security urged all developers who installed axios@1.14.1 or axios@0.30.4 to assume their environments are fully compromised. Their recommendation was explicit: immediately rotate all credentials that may have been exposed, including API keys and session tokens. For crypto-focused teams, that guidance extends to any keys or secrets that could be used to access internal tools, trading systems, or wallet infrastructure.
Socket advised a systematic review of project dependencies. Developers were told to check package manifests and lock files for references to the affected Axios versions and the plain-crypto-js@4.2.1 package. Any occurrence should be removed, and projects should be rolled back to safe releases. This process is essential not only for application code but also for build pipelines, testing environments, and scripts that might have run the compromised packages.
The Axios incident again highlights the particular risk for crypto organizations that heavily rely on open-source JavaScript libraries. Even a transient inclusion of a malicious dependency in a development workflow can be enough to leak secrets, later used to target production wallets or user accounts. Continuous monitoring of npm dependencies, strict version pinning, and rapid incident response procedures are increasingly becoming standard requirements in crypto software operations.
Prior crypto supply chain breaches show downstream impact
The Axios case follows earlier crypto incidents that also traced back to software supply chain weaknesses. On Jan. 3, onchain investigator ZachXBT reported that “hundreds” of wallets across Ethereum Virtual Machine-compatible networks were drained in an attack that pulled relatively small amounts from each address. While the total tally was spread across a wide victim base, the common pattern pointed toward a shared upstream compromise rather than isolated user mistakes.
Cybersecurity researcher Vladimir S. suggested that this broad wallet-draining event might be connected to a December breach involving Trust Wallet. That earlier incident resulted in around $7 million in losses across more than 2,500 wallets. Trust Wallet later indicated that the root cause may have been a supply chain compromise tied to npm packages included in its development workflow.
Taken together, the Trust Wallet breach, the multi-chain wallet drains reported in January, and the malicious Axios npm releases illustrate how attacks on developer tooling can ultimately surface as user-level crypto theft. Once attackers capture developer credentials or project secrets, they can pivot into production systems, inject malicious updates, or directly access wallet infrastructure, turning what started as a code dependency issue into a full-scale on-chain loss event.
Key takeaways
- Malicious Axios npm versions pulled in a dependency capable of remote access and data theft, including crypto wallet information.
- Security firms recommend treating affected systems as compromised and rotating all exposed credentials and API keys.
- Earlier incidents involving Trust Wallet and EVM wallets show how npm-related supply chain breaches can lead to direct crypto losses.
Conclusion
The Axios npm compromise reinforces the link between software supply chain security and the safety of digital assets. As crypto projects lean heavily on open-source JavaScript ecosystems, a single poisoned dependency can become a conduit for wallet drains and API key theft across many platforms. Developers and crypto companies that used the affected Axios releases now face urgent remediation work, while the broader industry is once again reminded that securing code dependencies is inseparable from protecting funds on-chain.
Disclaimer
The information provided in this article is for informational purposes only and should not be considered financial advice. The article does not offer sufficient information to make investment decisions, nor does it constitute an offer, recommendation, or solicitation to buy or sell any financial instrument. The content is opinion of the author and does not reflect any view or suggestion or any kind of advise from cryptonewsbytes.com. The author declares he does not hold any of the above mentioned tokens or received any incentive from any company.
Featured image created by AI
