Unit 42 details a global supply chain attack that affected multiple sectors through Axios, a widely used JavaScript library for HTTP communications. The breach began with the theft of the maintainer’s npm account, which allowed publishing malicious versions v1.14.1 and v0.30.4.
These updates included plain-crypto-js@4.2.1 as an hidden dependency. According to the analysis, this component acted as a remote access trojan (RAT) with reconnaissance and persistent installation capabilities on Windows, macOS, and Linux systems, significantly expanding the potential damage beyond the initial download moment.
The case illustrates how a compromise in a widely adopted package can turn into a cross-sector vector for organizations of different geographies, even when the malicious change arrives disguised as a legitimate update.