Axios package compromise and remediation steps

The axios npm package was compromised in an active supply chain attack discovered on March 31, 2026. Vercel investigated and implemented remediation actions. No Vercel systems were affected.

Affected versions: axios@1.14.1, axios@0.30.4, plain-crypto-js@4.2.1

Remediation actions:

• Blocked outgoing access from build infrastructure to Command & Control hostname
• Malicious package versions blocked and unpublished from npm
• Latest tag now points to safe axios@1.14.0 release

Recommended actions: Check dependencies and lockfiles, redeploy projects, rotate API keys and credentials, review dependency tree for affected versions.