Axios Library Compromised via ClickFix Attack

From there, the attackers arranged a Microsoft Teams meeting. During that meeting, the maintainer was shown a prompt claiming that software on his system was outdated and needed to be installed. He followed the instruction. The software was not an update. It was a remote access trojan.

Once installed, the RAT gave attackers access to the maintainer's system. According to Security.NL, they were then able to steal session cookies, tokens and other credentials. The attackers used this access to publish malicious versions of the Axios library.

Why does this matter?

Axios is an HTTP client library used by applications to handle web requests from browsers and Node.js environments. According to Security.NL, the library receives more than one hundred million weekly downloads on npmjs.com. That scale means a compromised version can reach a very large number of systems quickly.

It is not stated how many users downloaded the malicious versions, how long those versions were available, or whether any downstream users were confirmed to have been affected by the RAT.

This type of attack, where criminals build a convincing fake identity and workspace to earn someone's trust before delivering malware, is a reminder that threats do not always arrive through obvious routes like phishing emails. A professional-looking Slack workspace and a Teams meeting can be enough.

What does this mean for your website?

If your website or web application uses third-party software libraries, even well-known ones, it is worth knowing where those libraries come from and whether your developer or hosting provider monitors for compromised dependencies. You do not need to understand the technical details yourself, but asking your developer "do we check for security issues in the libraries we use?" is a reasonable question. For a broader overview of steps you can take, see our security checklist for small businesses and our guide on vulnerable plugins.