Security · High impactFan score 66 · Tier A
jsDelivr handed out the hijacked axios 940,000 times
The Brief
- jsDelivr served a hijacked axios package 940,000 times, according to its public stats.
- The cdn.jsdelivr.net/npm/axios@1 URL resolves to the newest 1.x release, which for about three hours on 31 March was 1.14.1.
- Version 1.14.1 was published by an attacker from the lead maintainer's npm account.
Why it matters
Script tags that use a floating major-version URL such as @1 can load a malicious release automatically, without any change on the developer's side.
Who’s affected
- Sites loading axios@1 from cdn.jsdelivr.net
What to do
- Check whether your pages load axios from cdn.jsdelivr.net with a floating @1 range.
- Pin axios to an exact, known-good version instead of a major-version range.
- axios 1.14.1
- #security
- #supply-chain
- #npm
- #axios
- #jsdelivr
- #cdn
cdn.jsdelivr.net/npm/axios@1 Put that in a script tag and the @1 means "whatever the newest 1.x is right now". For about three hours on 31 March, the newest 1.x was 1.14.1, the version an attacker published from the lead maintainer's npm account. jsDelivr's public stats count…
Timeline
Hijacked axios 1.14.1 became the newest 1.x version served by jsDelivr for about three hours
DEV Community: javascript
jsDelivr handed out the hijacked axios 940,000 times