What happened with the axios npm supply chain attack?

An attacker compromised the axios npm maintainer account ('jasonsaayman'), injected a cross-platform RAT via plain-crypto-js, affecting 100M weekly downloads. @shadanai/openclaw packages vendored the malicious payload.

Which axios versions are compromised?

Axios versions 1.14.1 and 0.30.4 are compromised. Clean versions: axios@1.14.0 (1.x) or axios@0.30.3 (0.x).

Which @shadanai/openclaw versions are affected?

Versions 2026.3.28-2, 2026.3.28-3, 2026.3.31-1, and 2026.3.31-2 contain the malicious dependency.

What are the IOCs for the axios attack?

C2 domain: sfrclak.com at IP 142.11.206.73. Compromised email: ifstap@proton.me. Malicious dep: plain-crypto-js@4.2.1.

How do I check if my OpenClaw install is affected?

Check your node_modules for axios@1.14.1 or axios@0.30.4, and scan for the plain-crypto-js dependency. Socket.dev, Snyk, and Semgrep have published detection tools.

← Back to dashboard

clawsmith.com/signal/shadanai-openclaw-npm-supply-chain-attack-axios

⚠ IssueUnknownSupply ChainLive

Axios npm supply chain attack: compromised maintainer ships RAT via @shadanai/openclaw packages

Attacker compromised the axios npm maintainer account, injected a cross-platform RAT via plain-crypto-js. @shadanai/openclaw packages vendored the malicious payload. 100M weekly downloads in blast radius. Affected axios versions: 1.14.1 and 0.30.4.

Product Idea from this Signal

A CLI security scanner that intercepts and blocks malicious ClawHub skills before they compromise your OpenClaw instance

183.3k ▲

ClawHub has 824+ malicious skills in circulation. 12% of published skills contain malicious code, supply chain rug-pulls, or data exfiltration payloads like AMOS stealer and ClawHavoc. OpenClaw's built-in VirusTotal integration only catches known signatures after publication, leaving zero-day threats and behavioral exploits wide open. This tool sits between ClawHub and your install command, running behavioral analysis, permission auditing, and network call inspection on every skill before it touches your system.

CLIOPEN-SOURCESECURITYDEVTOOL

Competitive75 leadsView Opportunity →