jsDelivr handed out the hijacked axios 940,000 times
cdn.jsdelivr.net/npm/axios@1 Put that in a script tag and the @1 means "whatever the newest 1.x is right now". For about three hours on 31 March, the newest 1.x was 1.14.1, the version an attacker published from the lead maintainer's npm account. jsDelivr's public stats count 941,960 requests for it, and 98.5% of them were for dist/axios.min.js , the browser build. None of that did any harm. The…
jsDelivr inadvertently distributed the compromised axios 940,000 times during a three-hour window on March 31st. The malicious version of axios originated from the lead maintainer's npm account, and jsDelivr's public statistics recorded 941,960 requests for this infected version, with 98.5% of them being for the browser build. The malware was introduced through a new dependency called plain-crypto-js, which dropped a remote access trojan when npm install was executed.
However, since a script tag does not install anything, the browser build remained unharmed. The attacker's main target was developers' laptops, but they also targeted certain browsers, including the lottie-player animation player, resulting in nearly 4,000 requests for their malicious versions. The hijack occurred rapidly due to jsDelivr's edge servers caching the latest version for up to 12 hours and the browser's caching mechanism, which keeps the file for up to a week.
To mitigate these risks, it is recommended to use exact version numbers and integrity hashes in the URL, or serve the files directly instead of relying on a CDN.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
