Supply-chain attack · high
jsDelivr served hijacked axios package 940,000 times
Tier A · Patch today – Before you go home
Who’s exposed: Sites loading axios@1 via jsDelivr script tags
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild · Supply chain
What to do
- Check whether your pages load axios from cdn.jsdelivr.net with a floating @1 range.
- Pin axios to an exact, known-good version instead of a major-version range.
The Brief
- jsDelivr served a hijacked axios package 940,000 times, according to its public stats.
- The cdn.jsdelivr.net/npm/axios@1 URL resolves to the newest 1.x release, which for about three hours on 31 March was 1.14.1.
- Version 1.14.1 was published by an attacker from the lead maintainer's npm account.
Why it matters
Script tags that use a floating major-version URL such as @1 can load a malicious release automatically, without any change on the developer's side.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: axios is a widely used JavaScript HTTP library, and jsDelivr is a CDN developers load in their apps. |
| No | Core infrastructure | Judgment: a single popular library, not core infrastructure like OpenSSH, the Linux kernel, or npm as a whole. |
| Yes | Popular tool | Judgment: axios is a mainstream, top-tier npm package used by many teams. |
| Yes | Exploited in the wild | DEV Community: jsDelivr handed out the hijacked axios 940,000 times after an attacker published 1.14.1. |
| No | Public exploit | DEV Community: no source says exploit code or a proof-of-concept was published. |
| No | Remote, no login | DEV Community: no source describes how the attacker gained access or whether it needed credentials. |
| No | Full takeover | DEV Community: no source states code execution or account takeover impact beyond the hijacked package. |
| No | Secrets exposed | DEV Community: no source reports stolen credentials, tokens, keys, or customer data. |
| Yes | Supply chain | DEV Community: attacker published malicious axios 1.14.1 from the lead maintainer's npm account, served via jsDelivr. |
| No | No fix yet | DEV Community: no source says whether a patched or clean version has been shipped. |
Timeline
Hijacked axios 1.14.1 became the newest 1.x version served by jsDelivr for about three hours
DEV Community: javascript
jsDelivr handed out the hijacked axios 940,000 times
Source
jsDelivr handed out the hijacked axios 940,000 times ↗ DEV Community: javascript · 1h ago
First seen · 1 source · Full story page · How tiers are decided