Description
A supply chain attack on the axios npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency ([email protected]) that deploys a cross-platform remote access trojan (RAT) on macOS, Windows, and Linux. The attacker compromised the primary axios maintainer’s npm account to publish the malicious versions.
Recommendation
Update the @lightdash/cli package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.1800.0, < 0.2695.1
- Patched version(s): 0.2695.1
References
Could your website be exposed too?
SmartScanner can check your website for Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios: Prototype pollution gadgets can alter axios request construction - Vulnerability
- Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios - Vulnerability
- Potential XSS in jQuery dependency in Mirador - Vulnerability
- Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated April 02, 2026