Historical intelligence backfill. This assessment covers reporting originally published on 2026-04-01 and was added to the RWP archive on 2026-09-07.
The Axios npm hijack was a three-hour window on a 70-million-download library — Microsoft says Sapphire Sleet
Malicious axios 1.14.1 and 0.30.4 shipped 31 March 2026 via a compromised maintainer, with postinstall C2 Microsoft attributes to DPRK actor Sapphire Sleet.
Bottom line up front
CONFIRMED On 31 March 2026 unauthorized axios@1.14.1 and axios@0.30.4 published to npm after a maintainer-account compromise. Axios is a default HTTP client at tens of millions of weekly downloads (Microsoft: 70M+). Malicious versions pulled a dependency (plain-crypto-js@4.2.1 in CSA Singapore's advisory) and ran install-time code that fetched a second stage. Microsoft, 1 April, told defenders to roll back to 1.14.0 or 0.30.3, pin exact versions (no ^/~), flush npm cache, and rotate secrets. Microsoft attributed C2 to Sapphire Sleet (DPRK). CSA Singapore independently listed the same versions and shasums. Azure Pipelines later stressed this was not a compromise of Azure DevOps itself — only of builds that resolved the bad versions.
Secondary reporting of a ~three-hour publish window and ~100M weekly downloads varies by outlet; use Microsoft/CSA version pins as the operational fact. Historical backfill of 1 April 2026 reporting; added 7 September 2026.
What happened
Trusted library, compromised publisher, postinstall, C2. Microsoft also warned of an update hook that keeps trying to move you onto the bad build — so "we patched forward" can be the worm. Pin, do not caret.
This is the same class as Shai-Hulud (already in the archive) with a different delivery: one famous package, not a worm through every maintainer token. Do not merge them.
Why it mattered
Axios sits in front-end and Node backends. A three-hour npm window still hits every CI that ran npm install without a lockfile pin. DPRK attribution, if you accept Microsoft/GTIG, means crypto-theft and espionage follow-on, not just a miner.
Who / what was affected
Any project that resolved 1.14.1 or 0.30.4, including transitives. Developer laptops and build agents. OT not claimed.
Technical context
Microsoft/CSA: remove plain-crypto-js, downgrade, rotate API keys and npm/GitHub/cloud tokens, inspect /tmp/ld.py-class artifacts on Linux, reimage agents that ran the install. Azure DevOps listed hunting for sfrclak[.]com / 142.11.206.73:8000 — treat as time-bounded IOCs.
Exploitation / threat status at the time
CONFIRMED malicious versions, maintainer compromise, Microsoft/CSA rollback advice.
CONFIRMED as Microsoft attribution: Sapphire Sleet.
REPORTED short window; CISA later advisory in secondary press (20 April) — verify against primary if using for compliance.
What defenders should have done
- Lockfile audit for the two versions; overrides to force 1.14.0/0.30.3.
- Rotate every secret that touched those build agents.
- Disable dependabot auto-merge on HTTP clients until pins exist.
- Assume CI is as trusted as prod; it just published your next image.
What we know now
Azure's 24 April pipeline note is the cloud-CI coda. The pin-exact-version lesson is the durable control, including against the next library.
RWP assessment
Confidence: High on versions and rollback. Moderate-high on Sapphire Sleet as Microsoft/GTIG-aligned attribution.
Defensive actions
- Exact version pins for axios and other HTTP clients.
- Block install scripts in CI where feasible.
- Credential rotation if the window overlapped your builds.
- Maintainer 2FA/passkeys as a vendor requirement.
Sources
- Microsoft Threat Intelligence — Mitigating the Axios npm supply-chain compromise
- Cyber Security Agency of Singapore — Advisory on Axios supply chain attack
- Azure DevOps — Axios npm compromise guidance for Azure Pipelines
- Microsoft Threat Intelligence — X attribution to Sapphire Sleet