Executive Summary

The axios npm package — used by hundreds of thousands of JavaScript and Node.js projects and downloaded over 300 million times — was compromised in a confirmed supply chain attack attributed to Lazarus Group, a North Korean state-sponsored threat actor. Malicious versions v1.14.1 and v0.30.4 were published to the official npm registry on or around March 31, 2026, embedding NukeSped, a cross-platform Remote Access Trojan capable of running on Windows, macOS, and Linux. Any organization whose software pipelines installed or updated to these specific versions during the availability window may have deployed a backdoor into production, CI/CD, or developer environments.

Technical Analysis

Affected versions: axios v1.14.1 and v0.30.4 on the npm registry. Attack vector: compromise of the axios npm publishing account or its CI/CD pipeline (T1195.002 — Software Supply Chain), enabling direct publication of trojanized packages to the official registry. The embedded payload is NukeSped, a RAT family previously attributed to Lazarus Group in CISA and US-CERT advisories. NukeSped provides remote command execution (T1059), ingress tool transfer (T1105), and C2 communication over standard web protocols (T1071.001). The malware is cross-platform, targeting Windows, macOS, and Linux. Exploitation requires only that a dependent project install or update to the malicious version — no additional user interaction needed. Relevant CWEs: CWE-1357 (reliance on insufficiently trustworthy component), CWE-494 (download of code without integrity check), CWE-506 (embedded malicious code). No CVE has been assigned as of this writing. Legitimate axios versions are unaffected; v1.14.0 and v0.30.3 are the last known-clean versions in their respective release lines. Compromise confirmed by Socket.dev, StepSecurity, Snyk, Wiz, and SANS Institute.

Action Checklist

1. Containment — Immediately audit all package-lock.json, yarn.lock, and package.json files across repositories, pipelines, and deployed environments. Identify any reference to axios v1.14.1 or v0.30.4. Isolate affected systems from the network pending investigation. Block outbound connections from systems confirmed to have installed either malicious version while investigation proceeds.
2. Detection — Query SIEM and EDR for process execution anomalies on Node.js hosts: unexpected child processes spawned by node, outbound connections from node or npm processes to unfamiliar external IPs, and new scheduled tasks or persistence mechanisms created around the install timestamp. Review npm audit logs and CI/CD pipeline logs for install events matching the malicious versions. Check for NukeSped IOCs (see iocs field) against endpoint and network telemetry. On Linux/macOS, inspect cron, launchd, and systemd unit files for entries added after the suspected install window.
3. Eradication — Downgrade axios to v1.13.9 (last stable v1.x before compromise) or pin to a verified clean version confirmed by your security team against the legitimate npm registry checksum. Run npm cache clean –force after removal to purge cached malicious packages. Rotate all secrets, tokens, API keys, and credentials accessible from any environment where the malicious version was installed — NukeSped enables full remote access and credential harvesting. Rebuild affected containers and deployment artifacts from clean base images.
4. Recovery — Redeploy from clean, verified build artifacts. Confirm axios version in all deployed environments post-remediation. Monitor affected hosts for 30+ days for residual C2 beaconing, lateral movement indicators, or persistence re-establishment. Validate that credential rotations are complete and that no lateral movement occurred from compromised developer or CI/CD environments into production systems.
5. Post-Incident — This incident exposes gaps in software supply chain integrity controls. Implement or enforce npm package integrity verification (e.g., package-lock.json integrity hashes, npm audit in CI gates). Evaluate adoption of SLSA framework controls for build provenance. Enable two-factor authentication on all npm publishing accounts. Integrate a software composition analysis (SCA) tool into CI/CD pipelines with alerting on unexpected version changes to high-dependency packages. Review CISA and MITRE ATT&CK guidance on T1195.002 for additional defensive controls.

Detection Guidance

Primary detection focus: identify install events for axios v1.14.1 or v0.30.4 in your environment, then pivot to behavioral indicators of NukeSped activity. Query package-lock.json and yarn.lock files in all repositories for exact version strings ‘1.14.1’ or ‘0.30.4’ under the axios entry. In CI/CD logs, search for npm install or yarn add events resolving to these versions within the March 31, 2026 window and after. On endpoints, look for: (1) node.js processes initiating outbound TCP connections to external IPs not in your known allowlist; (2) new persistence artifacts (registry run keys on Windows, launchd plists on macOS, cron/systemd entries on Linux) created in the timeframe following package install; (3) unexpected execution of cmd.exe, powershell.exe, /bin/sh, or /bin/bash as child processes of node. Network: alert on DNS queries and outbound connections to unfamiliar domains or IPs from developer workstations and CI/CD runners, particularly over ports 443, 80, or non-standard high ports. NukeSped C2 communication has historically used HTTP/S with encoded payloads — look for beaconing patterns with regular intervals. Cross-reference any identified IPs/domains against Lazarus Group IOC feeds from CISA, US-CERT, and threat intelligence platforms.