Disponibili Proof of Concept (PoC) per lo sfruttamento di 7 vulnerabilità con gravità "alta" presenti nel prodotto axios.
EPSS 0.01 CVE-2026-101898 CVE-2026-101901 CVE-2026-101903 CVE-2026-101905 CVE-2026-101906 CVE-2026-101907 CVE-2026-101909 axios IT
A few weeks after the major axios npm supply chain attack, a group of researchers from Huntress, Wiz, and Aikido Security debriefed on the compromise’s lasting impacts.
axios US
Axios CVE-2026-40175 is rated critical, but in real Node.js environments it’s not practically exploitable. Here’s why. Category: Vulnerabilities & Threats
EPSS 0.01 CVE-2026-40175 axios BE
Preamble Last Monday night I was working late and a Slack alert came in from a monitoring tool I had built three days earlier. Axios compromised; one of the most popular npm packages in the world. My heart started racing, I knew every second mattered to respond and limit the damage. But honestly it was so crazy that I thought it must be a false positive. I checked and rechecked everything a few times even though it seemed very obviously malicious. It wasn't a false positive. It was one of the…
axios US
A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézet (NBSZ NKI) riasztást ad ki az Axios JavaScript könyvtár npm ellátási láncát érintő kritikus kompromittálódás miatt.
axios HU
Elastic Security Labs released initial triage and detection rules for the Axios supply-chain compromise. This is a detailed analysis of the RAT and payloads. Introduction Elastic Security Labs identified a supply chain compromise of the axios npm package, one of the most depended-upon packages in the JavaScript ecosystem with approximately 100 million weekly downloads. The attacker compromised a maintainer account and published backdoored versions that delivered a cross-platform Remote Access…
Elastic Security Labs is releasing an initial triage and detection rules for the Axios supply-chain compromise. We have released a detailed analysis on the Axios compromise RAT and payloads. Elastic Security Labs filed a GitHub Security Advisory to the axios repository on March 31, 2026 at 01:50 AM UTC to coordinate disclosure and ensure the maintainers and npm registry could act on the compromised versions. Introduction We are currently tracking a supply chain attack involving malicious Axios…
axios US
An NPM supply chain attack struck the ubiquitous open-source axios library and Huntress has observed over a hundred affected devices.
axios US
31. März 2026 Beschreibung Die weit verbreitete JavaScript-Bibliothek axios (HTTP-Client mit über 300 Millionen wöchentlichen Downloads auf npm) wurde durch kompromittierte Paketversionen als Angriffsvektor missbraucht. Über den gekaperten npm-Account eines Hauptentwicklers wurden zwei schadhafte Versionen veröffentlicht: axios@1.14.1 und axios@0.30.4. Beide Versionen enthalten eine zusätzliche Abhängigkeit (plain-crypto-js@4.2.1), die beim Installieren automatisch einen Remote Access Trojaner …
axios AT
The malicious versions of axios differed from legitimate releases by including a dependency on plain-crypto-js, a trojanized package. These versions were published directly via a compromised maintainer account and later removed from npm following disclosure. Due to the short e...
axios US
A supply chain attack hit Axios when attackers used stolen npm credentials to publish malicious versions containing a phantom dependency. This triggered a cross-platform RAT during installation and replaced its files with clean decoys, making detection challenging.
axios JP