Security Incident
axios npm package Supply Chain Attack
Socket has detected an active supply chain attack targeting version 1.14.1 of the core npm package, axios.
- Reported loss
- 0
- Attack category
- Supply Chain Attack
Incident Overview
The attacker injected malicious code into axios by introducing a malicious dependency that first appeared today. Developers using axios are advised to pin their versions immediately and review their project lockfiles.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.