# jsDelivr handed out the hijacked axios 940,000 times

Source: [DEV Community: javascript](https://dev.to/notaflightrisk/jsdelivr-handed-out-the-hijacked-axios-940000-times-208f) · 2026-11-09 · Frontend
Page: https://themorning.dev/story/jsdelivr-handed-out-the-hijacked-axios-940-000-times-a4d7d0aef158342e
Kind: security · Impact: high

## In brief

- jsDelivr served a hijacked axios package 940,000 times, according to its public stats.
- The cdn.jsdelivr.net/npm/axios@1 URL resolves to the newest 1.x release, which for about three hours on 31 March was 1.14.1.
- Version 1.14.1 was published by an attacker from the lead maintainer's npm account.

## Why it matters

Script tags that use a floating major-version URL such as @1 can load a malicious release automatically, without any change on the developer's side.

## What to do

- Check whether your pages load axios from cdn.jsdelivr.net with a floating @1 range.
- Pin axios to an exact, known-good version instead of a major-version range.

## Versions

- axios 1.14.1

## Timeline

- 2026-03-31: Hijacked axios 1.14.1 became the newest 1.x version served by jsDelivr for about three hours

## Coverage

- [jsDelivr handed out the hijacked axios 940,000 times](https://dev.to/notaflightrisk/jsdelivr-handed-out-the-hijacked-axios-940000-times-208f) — DEV Community: javascript, 2026-11-09

Tags: security, supply-chain, npm, axios, jsdelivr, cdn

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev