Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions
- Severity:
- High
Description
A supply chain attack on the axios npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency ([email protected]) that deploys a cross-platform remote access trojan (RAT) on macOS, Windows, and Linux. The attacker compromised the primary axios maintainer’s npm account to publish the malicious versions.
Recommendation
Update the @lightdash/cli package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.1800.0, < 0.2695.1
- Patched version(s): 0.2695.1
References
Related Issues
- Axios: Prototype pollution gadgets can alter axios request construction - Vulnerability
- Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios - Vulnerability
- Potential XSS in jQuery dependency in Mirador - Vulnerability
- Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` - Vulnerability
You might also like:
- Tags:
- npm
- @lightdash/cli
Anything's wrong? Let us know Last updated on April 02, 2026