Axios npm supply chain attack (31 March 2026) — is WeWeb affected?

Ask us anything
1

For anyone who hasn’t seen it yet: earlier today, two compromised versions of axios were published to npm (1.14.1 and 0.30.4). An attacker hijacked the lead maintainer’s npm account and injected a malicious dependency that drops a RAT via a postinstall script. The compromised versions were live for roughly 2-3 hours before npm pulled them. Full write-up from StepSecurity here: axios Compromised on npm - Malicious Versions Drop Remote Access Trojan - StepSecurity

Since WeWeb’s build pipeline presumably runs npm install on its servers when bundling projects, I wanted to ask:

  1. Does WeWeb use axios as a dependency (I believe it does)?
  2. Did any WeWeb build servers run npm install during the exposure window (~00:21–03:15 UTC on 31 March)?
  3. If so, has the team confirmed whether the compromised version was pulled, and have the appropriate steps been taken on the build infrastructure?

To be clear — the malicious payload targets the machine running npm install (i.e. WeWeb’s servers), not end users’ browsers. The axios source code itself wasn’t modified. But if build infrastructure was compromised, that’s obviously a broader platform concern.

Would be great to get confirmation from the WeWeb team that this has been checked. Thanks.

2

Hey Jon :waving_hand:

I believe WeWeb projects are not affected as we didn’t release anything during the exposure window.

But let me get the full picture from the tech team and get back to you on this :slight_smile:

3

Thanks Joyce - had confirmation from Daniel that WeWeb projects were not affected. With regards to WeWeb infrastructure, it’s the same. Nothing was compromised. WeWeb uses Axios 1.12, same for exported projects.

Hopefully this thread can help others looking for confirmation – though a proactive customer alert might give some comfort too.