Axios Has 100 Million Weekly Downloads. North Korea Backdoored It in 39 Minutes.

Yesterday — March 31, 2026 — a North Korea-linked threat actor hijacked the npm account of an Axios maintainer and published two backdoored versions of the most widely used HTTP client in the JavaScript ecosystem. Axios has over 100 million weekly downloads. It sits underneath LangChain, OpenAI's SDK, dozens of MCP clients, and virtually every Node.js application that makes an HTTP request. If you're running AI agents in production, your dependency tree almost certainly includes it — even if you never installed it directly. The malicious versions were live for approximately three hours before detection and removal. In that window, every npm install that resolved to [email protected] or [email protected] silently installed a cross-platform remote access trojan. This is not a theoretical risk. This is what happened yesterday. What Happened At 00:21 UTC on March 31, an attacker published [email protected] using a compromised maintainer account (jasonsaayman). Thirty-nine minutes later, they published ax