Axios Compromised: How a Backdoored npm Package Dropped a RAT on 100M+ Downloads

Axios Compromised: How a Backdoored npm Package Dropped a RAT on 100M+ Downloads The JavaScript ecosystem just suffered one of its most significant supply chain attacks in recent memory. Axios , the ubiquitous HTTP client library downloaded over 100 million times per week , was compromised when attackers gained access to a maintainer's npm account and pushed malicious versions containing a Remote Access Trojan (RAT). This is not just another security headline. If you use Node.js in any capacity—whether for backend APIs, frontend builds, or DevOps scripts— this incident affects you directly . Índice What Happened How the Attack Worked The Timeline of Events Which Versions Were Affected How to Check if You Were Affected What Attackers Could Do With the RAT The npm Ecosystem Problem How to Protect Yourself Lessons Learned Conclusion What Happened On March 30, 2026, security researchers at StepSecurity discovered that the popular axios npm package—used by millions of developers for making