What is axios — and why should you care?
You've probably never heard of axios. But if your business uses any modern website, web app, booking system, or client portal, axios almost certainly runs somewhere in the background. It's a networking tool that helps apps communicate over the internet — trusted, invisible, and used by over 100 million projects every single week.
Today, attackers turned that trust into a weapon.
What happened — in plain English
Hackers compromised the npm account of axios's lead developer and published two poisoned versions containing a hidden dependency called plain-crypto-js. The moment any developer ran a routine update during the attack window, a Remote Access Trojan was silently dropped — then deleted all evidence of itself.
Malicious versions: axios@1.14.1 and axios@0.30.4 — live between 00:21 and 03:29 UTC on March 31, 2026. Any machine that ran npm install during this window should be treated as fully compromised.
How to check if you're affected
If you or your developer ran any software updates today, run this in Terminal (Mac/Linux):
On Windows PowerShell:
What Digital Evolutions did this morning
- Verified axios version on all managed machines — confirmed 1.4.0 (safe) across the board
- Searched all project lockfiles for the malicious dependency plain-crypto-js — not found
- Checked npm global installs and local node_modules on each machine
- Reviewed automated pipeline logs covering the March 31 UTC attack window
- Blocked egress traffic to the attacker's C2 server at the network level
- Documented all findings for compliance and client records
Why this matters for your small business
This attack didn't target Fortune 500 companies. It targeted the invisible infrastructure every small business web app quietly depends on. Having IT support that monitors threats around the clock is the difference between a 10-minute audit and a months-long breach investigation.
Digital Evolutions provides 24/7 proactive IT security and monitoring for small businesses in Las Vegas and beyond. No business hours. No waiting until Monday. Real protection when it counts.
Get a Free Security Consultation