Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

The Axios npm package was compromised on March 31 through a targeted social engineering attack against the maintainer Jason Saayman. Attackers posed as a legitimate company, gained access to the maintainer's machine, and hijacked active sessions to publish malicious versions containing a remote access trojan. The malicious packages affected macOS, Windows, and Linux systems. The attack bypassed traditional security controls like 2FA because the attackers operated with the maintainer's legitimate access. This incident highlights the vulnerability of the open source supply chain and the burden placed on individual maintainers who maintain critical infrastructure with limited security resources.