Axios package compromise: what to know and how to remediate

Announcements
1

We’re sharing an important security update regarding a recent supply chain attack on the axios npm package. While Vercel’s systems remain unaffected, we want to help you ensure your projects are secure.

The compromise affects projects using axios@1.14.1, axios@0.30.4, or plain-crypto-js@4.2.1. We have already blocked outgoing access from our build infrastructure to the known malicious Command & Control hostname to provide immediate protection.

What you should do

  • Check your dependencies: Look for the affected versions in your lockfiles or node_modules to identify potential exposure.
  • Update and redeploy: Ensure you are using the safe axios@1.14.0 release and trigger a new deployment.
  • Rotate secrets: If you used the malicious versions, we recommend rotating any API keys, database credentials, or tokens present in your build environment.

Have you checked your dependencies yet? Let us know if you have any questions about securing your builds below :backhand_index_pointing_down:

1 Like