Skip to content
AgentProv

2026-03-31 · 2026-Q1

Axios npm Supply Chain Attack

Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.

Fixable
Vendor patch
Vendor response
Patched
In the wild
Yes
Actor
Not applicable

Target

Axios (70-100M weekly npm downloads)

Impact

Malicious versions tagged "latest" delivered cross-platform RAT via dependency "plain-crypto-js"

Root cause

Social engineering of lead maintainer's npm credentials by Sapphire Sleet / UNC1069 (DPRK)

Sources

Catalog

Cite this: AgentProv incident record: Axios npm Supply Chain Attack (2026-03-31). https://agentprov.com/incidents/2026-03-31-axios-npm-supply-chain-attack