# Axios NPM Supply Chain Attack Bypasses GitHub Actions CI/CD

> A sophisticated supply chain attack targeted the Axios NPM package, leveraging a compromised token to bypass GitHub Actions CI/CD and deploy malicious versions.

- Published: 2026-04-01T12:28:22.000Z
- Severity: high
- Category: Supply Chain
- Tags: Axios, NPM, Supply Chain Attack, North Korea, GitHub Actions, CI CD
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/axios-npm-package-breached-in-north-korean-supply-chain-attack/
- Canonical: https://runtimerebel.com/blog/axios-npm-supply-chain-attack-bypasses-github-actions-ci-cd

## Key points

- Users of `axios` NPM package risk executing backdoored code from malicious versions.
- Affected systems include environments consuming `axios` versions published via a compromised CI/CD pipeline.
- Immediately audit `axios` package integrity and review all repository access token lifespans and permissions.

## Axios NPM Supply Chain Attack Bypasses GitHub Actions CI/CD

A critical [Supply Chain Attack](/glossary#supply-chain-attack) has compromised the popular `axios` NPM package, a widely used JavaScript HTTP client library. This incident highlights persistent vulnerabilities in software supply chains, particularly concerning package publishing mechanisms and [CI/CD](https://en.wikipedia.org/wiki/CI/CD) security practices. Threat actors leveraged a long-lived NPM access token to bypass modern security measures, specifically [GitHub Actions](https://github.com/features/actions/) [OIDC](https://openid.net/connect/)-based publishing workflows, to push backdoored versions of the package. This sophisticated attack, which has been linked to North Korean state-sponsored activities in reports, poses a significant risk to any application or system consuming the compromised `axios` versions, as reported by [SecurityWeek](https://www.securityweek.com/axios-npm-package-breached-in-north-korean-supply-chain-attack/).

### Technical Analysis of the Axios NPM Breach

The core of this [supply chain attack](https://en.wikipedia.org/wiki/Supply_chain_attack) centered on the compromise and misuse of a long-lived NPM access token. While modern development practices increasingly advocate for ephemeral, short-lived credentials managed through mechanisms like [OIDC](https://openid.net/connect/) within [CI/CD](https://en.wikipedia.org/wiki/CI/CD) pipelines, the existence and exploitation of an older, persistent token allowed attackers to circumvent these safeguards.

Traditionally, [CI/CD](https://en.wikipedia.org/wiki/CI/CD) systems, such as [GitHub Actions](https://github.com/features/actions/), integrate with package registries to automate the publishing process. Best practices involve using [OIDC](https://openid.net/connect/) to issue temporary, scoped tokens for publishing. This limits the window of opportunity for attackers should a token be compromised. In this instance, the attackers exploited a pre-existing, long-lived token, effectively bypassing the intended secure publishing workflow. This [TTP](/glossary#ttp) demonstrates a sophisticated understanding of development infrastructure and the ability to identify and exploit legacy security weaknesses.

The immediate threat is the potential for arbitrary code execution in environments where the backdoored `axios` package versions are installed and utilized. A malicious version of a widely depended-upon library like `axios` could allow attackers to:

*   Exfiltrate sensitive data (e.g., API keys, user credentials, environment variables).
*   Establish persistent access within development or production systems.
*   Perform [Lateral Movement](/glossary#lateral-movement) within affected networks.
*   Deploy additional malware or backdoors.

The reported link to North Korean state-sponsored actors implies a highly resourced and persistent threat with strategic objectives, potentially focusing on intelligence gathering or economic espionage.

### Mitigating Supply Chain Attacks on GitHub Actions CI/CD

Preventing and responding to sophisticated [supply chain attacks](https://en.wikipedia.org/wiki/Supply_chain_attack) requires a multi-layered approach focusing on both proactive security measures and rapid incident response capabilities. For organizations relying on popular NPM packages and [GitHub Actions](https://github.com/features/actions/) [CI/CD](https://en.wikipedia.org/wiki/CI/CD), several actions are critical.

#### Detecting Malicious Axios NPM Package Versions

To determine if your projects are affected, review your dependency trees and examine the integrity of `axios` package versions.

*   **Audit Dependencies:** Use `npm list axios` or similar tools to identify all instances of `axios` in your projects.
*   **Integrity Checks:** Verify package integrity using cryptographic hashes (e.g., `npm audit`, `yarn audit`). While the compromised versions might have valid hashes *at the time of publication*, anomalous version numbers or unexpected code changes within the package should trigger alerts.
*   **Version Pinning:** Strongly consider pinning exact versions of critical dependencies in `package.json` to prevent automatic upgrades to potentially malicious releases.

#### Hardening CI/CD Pipelines and Access Tokens

This incident underscores the impact of compromised NPM access tokens.

*   **Token Lifecycle Management:** Transition away from long-lived personal access tokens for automated processes. Implement [OIDC](https://openid.net/connect/) or similar mechanisms to generate ephemeral, short-lived tokens with minimal necessary permissions for [CI/CD](https://en.wikipedia.org/wiki/CI/CD) pipelines.
*   **Principle of Least Privilege:** Ensure that all tokens, whether long-lived or ephemeral, adhere strictly to the principle of least privilege. Tokens should only have permissions required for their specific function.
*   **Regular Audits:** Conduct regular audits of all API keys, tokens, and credentials stored or used within your [CI/CD](https://en.wikipedia.org/wiki/CI/CD) environments. Rotate these credentials frequently.
*   **Multi-Factor Authentication (MFA):** Enforce [MFA](https://en.wikipedia.org/wiki/Multi-factor_authentication) for all accounts with publishing privileges to package registries and source code repositories.
*   **Dependency Review:** Integrate dependency scanning and software composition analysis (SCA) tools into your [CI/CD](https://en.wikipedia.org/wiki/CI/CD) pipeline to automatically detect known vulnerabilities or unexpected changes in third-party libraries.

Implementing a [Zero Trust](/glossary#zero-trust) architecture, where no entity is trusted by default, even if inside the network perimeter, can further reduce the attack surface against such sophisticated [supply chain attacks](https://en.wikipedia.org/wiki/Supply_chain_attack). Monitoring build processes for anomalies and integrating behavioral analytics can also help identify suspicious activities that deviate from established baselines.

**Related:** [UNC1069 Leverages Axios NPM Supply Chain to Deploy WAVESHAPER.V2](/blog/unc1069-leverages-axios-npm-supply-chain-to-deploy-waveshaper-v2), [Axios NPM Compromise: Supply Chain Threat Analysis](/blog/axios-npm-compromise-supply-chain-threat-analysis)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/axios-npm-supply-chain-attack-bypasses-github-actions-ci-cd