Governing Security in the Age of Infinite Signal – From Discovery to Control
2026-04-21T08:52:00Z•f7b8d6839cb654d8c1b46511300ccae361b07bc8c7a80e5a3db9ebbffb3788a1
RATauditaxiosdependency‑injectionincident-responsemaintainer-compromisemalicious-packagenpmremediationremote-access-trojansoftware-supply-chainsupply-chain
What happened
Snyk reports a npm supply‑chain compromise of the Axios package: attacker(s) published malicious releases (notably 1.14.1 and 0.30.4) via a compromised maintainer account that introduce a hidden dependency which deploys a cross‑platform remote access trojan (RAT). Projects that install those versions (directly or transitively) are at risk; Snyk guidance covers who’s affected and how to check exposure and remediate (remove/pin/rollback, rotate secrets, rebuild artifacts, audit lockfiles and dependency trees).
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- snyk_blog
- Record identifier
- f7b8d6839cb654d8c1b46511300ccae361b07bc8c7a80e5a3db9ebbffb3788a1
- Enrichment time
- 2026-04-21T08:52:00Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.