Axios attacker strikes again! Three NPM packages have been hiding in plain sight for two months
Contents
Discovery
The OpenSourceMalware team has discovered a group of three malicious packages that deliver a powerful infostealer, and whom appear to be connected to the high-profile Axios package compromise that shook the JavaScript ecosystem in March 2026. While the security community focused on the immediate Axios incident response, the same threat actor was quietly deploying secondary infrastructure that has been harvesting developer credentials for nearly two months.
These packages represent a sophisticated follow-up campaign, using the same cryptographic keys as the original Axios attack but employing different command & control infrastructure to evade detection efforts focused on the known Axios IOCs.
redeem-onchain-sdk versions
The Background
On March 31, 2026, attackers compromised the npm account of axios lead maintainer Jason Saayman via a social engineering campaign (fake company, branded Slack …On March 31, 2026, attackers compromised the npm account of axios lead maintainer Jason Saayman via a social engineering campaign (fake company, branded Slack workspace, Teams …
The OpenSourceMalware team has discovered a group of three malicious packages that deliver a powerful infostealer, and whom appear to be connected to the high-profile Axios package compromise that shook the JavaScript ecosystem in March 2026. While the security community focused on the immediate Axios incident response, the same threat actor was quietly deploying secondary infrastructure that has been harvesting developer credentials for nearly two months.
These packages represent a sophisticated follow-up campaign, using the same cryptographic keys as the original Axios attack but employing different command & control infrastructure to evade detection efforts focused on the known Axios IOCs.
redeem-onchain-sdk versions
The Background
On March 31, 2026, attackers compromised the npm account of axios lead maintainer Jason Saayman via a social engineering campaign (fake company, branded Slack …On March 31, 2026, attackers compromised the npm account of axios lead maintainer Jason Saayman via a social engineering campaign (fake company, branded Slack workspace, Teams …