Axios package compromise and remediation steps
By Steven Van ·
Vercel says its own systems were unaffected, but flags axios@1.14.1, axios@0.30.4 and plain-crypto-js@4.2.1 for lockfile checks and credential rotation.
A supply chain attack compromised the axios npm package, discovered on March 31, 2026. Vercel says its own systems and applications were unaffected, but projects that pulled the malicious versions into their build environments are exposed.
npm has removed the compromised releases and pointed the axios latest tag back to the safe 1.14.0 version. Vercel has blocked outgoing access from its build infrastructure to the attack's command and control host, sfrclak.com, and the malicious package version has been unpublished from npm.
Vercel is telling customers to check their dependencies and lockfiles for:
- axios@1.14.1
- axios@0.30.4
- plain-crypto-js@4.2.1
Projects that used these versions in a build environment should search lockfiles and node_modules for plain-crypto-js, redeploy so the build uses a clean axios version, rotate any API keys, database credentials and tokens present in that build environment, and update dependency trees referencing the affected axios versions to 1.14.0.
