2026-03-31 · 2026-Q1
Axios npm Supply Chain Attack
Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- Yes
- Actor
- Not applicable
Target
Axios (70-100M weekly npm downloads)
Impact
Malicious versions tagged "latest" delivered cross-platform RAT via dependency "plain-crypto-js"
Root cause
Social engineering of lead maintainer's npm credentials by Sapphire Sleet / UNC1069 (DPRK)
Sources
Catalog
Cite this: AgentProv incident record: Axios npm Supply Chain Attack (2026-03-31). https://agentprov.com/incidents/2026-03-31-axios-npm-supply-chain-attack