Just an update regarding the recent Axios hack

[Lissy93]

TL;DR
Early this morning Axios was compromised by a sophisticated and severe supply chain attack.
Dashy is unaffected. But there were some useful lessons to be learnt.
Thank you @fish-not-phish for your contributions in this

---

Impact Assessment

Docker Version

Summary: Dashy is safe.

• Dashy relies upon axios@^1.12.0 which will resolve to axios@1.13.6, which isn't in the vulnerable range (axios@1.14.1 and axios@0.30.4)
• The Dockerfile installs dependencies with yarn install --immutable, so it will refuse to resolve Axios to any version other than 1.13.6.
• In terms of the attack timing, the newest versions of Dashy (latest, 3.2.0, 3.x and 3.2) was published Mar 30, 07:57 UTC, which was 16 hours before the vulnerability window.
• Axios is never used as a transitive dependency, so the version in the package.json/yarn.lock is the only version

I've followed the steps form Stepsecurity.io's write up to grep through the node_modules for the bad plain-crypto-js package, and confirmed that it is not present in any versions of Dashy published. I've also reviewed all logs from my own staging environments to verify no C2 domain mentioned.

Custom / Modified Versions

However, if you are running a modified fork of Dashy, then you will need to check this yourself:

# 1. Bad version in lockfile?
grep -E '"axios": ".*(1\.14\.1|0\.30\.4)' yarn.lock

# 2. Is the malicious dependency present?
ls node_modules/plain-crypto-js 2>/dev/null && echo "⚠️ POSSIBLE COMPROMISE"

# 3. Do you see any RAT artifacts?
ls -la /tmp/ld.py 2>/dev/null && echo "⚠️ COMPROMISED"

If any of the following return true, then rebuild and rotate all secrets immediatly.

---

Background

Some of you might already be aware, but Axios is a popular NPM package providing a promise-based HTTP client for the browser and node.js.

Dashy (and 20M other projects!) heavily relied upon Axios before browser and Node fetch support was well supported.

Early this morning, the maintainer of Axios was compromised (likely by the previous NPM attack and wave of token / maintainer account compromise), and two bad versions of Axios (1.14.1 and 0.30.4) were published, and stayed live for 3 hours 00:21 to 03:29 UTC on Tue 31st March).

The attacker didn't modify Axios itself, but rather they added a new dependency (plain-crypto-js@4.2.1) to the package.json. That package looked like the legit crypto-js package, but had a malicious postinstall script which executed during npm install, downloading and running a cross-platform RAT.

When installed, this script executed immediately during npm install, acting as a dropper:

• Contacted a C2 server (http://sfrclak.com:8000)
• Downloaded a platform-specific second-stage payload (macOS, Windows, Linux)
• Executed it in the background (detached from the install process)

After execution, the malware:

• Deleted itself (setup.js)
• Replaced its own package.json with a clean decoy (reporting a safe version)
• Left the installed package appearing legitimate

The hack has so far been attributed to North Korea.

For more info about this this incident, take a look at these sources:

• The original write-up:
  https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
• The Register: https://www.theregister.com/2026/03/31/axios_npm_backdoor_rat/
• Low Level's informative video: https://www.youtube.com/watch?v=yiLIZLPNEm8
• Or, Fireship's short summary: https://www.youtube.com/watch?v=o7NYXvYohYk
• And, this GH issue: axios@1.14.1 and axios@0.30.4 are compromised axios/axios#10604

---

Action Taken

• Even though Dashy was not impacted, I've decided that removing the use of Axios is the best route forwards. I've refactored it out of the codebase in Update/remove axios #2027, which will be released shortly in v 3.2.1
• There's still a lot of other dependency updates underway, which will be released once Migrate Dashy to Vue 3, Vite and Node 24 #2002 is merged
• I have enabled private vulnerability reporting for Dashy (so anyone can submit an advisory). And, as with before any security concerns can be reported to security@as93.net

---

Action Required

No action is needed from you

Tip

If you run a lot of self-hosted services, consider blocking all traffic to the known C2 server:
echo "0.0.0.0 sfrclak.com" >> /etc/hosts

Stay safe 🩵