axios-1.14.1.tgz: 1 vulnerabilities (highest severity is: 9.6)

[mend-bolt-for-github]

Vulnerable Library - axios-1.14.1.tgz

Path to dependency file: /frontend/explorer/package.json

Path to vulnerable library: /frontend/explorer/node_modules/plain-crypto-js/package.json

Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (axios version)	Remediation Possible**
MSC-2026-3522	Critical	9.6	detected in multiple dependencies	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

MSC-2026-3522

Vulnerable Libraries - plain-crypto-js-4.2.1.tgz, axios-1.14.1.tgz

plain-crypto-js-4.2.1.tgz

JavaScript library of crypto standards.

Library home page: https://registry.npmjs.org/plain-crypto-js/-/plain-crypto-js-4.2.1.tgz

Path to dependency file: /frontend/explorer/package.json

Path to vulnerable library: /frontend/explorer/node_modules/plain-crypto-js/package.json

Dependency Hierarchy:

• axios-1.14.1.tgz (Root Library)
  • ❌ plain-crypto-js-4.2.1.tgz (Vulnerable Library)

axios-1.14.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-1.14.1.tgz

Path to dependency file: /frontend/explorer/package.json

Path to vulnerable library: /frontend/explorer/node_modules/axios/package.json

Dependency Hierarchy:

• ❌ axios-1.14.1.tgz (Vulnerable Library)

Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183

Found in base branch: main

Vulnerability Details

The plain-crypto-js npm package version 4.2.1 contains a malicious postinstall script that deploys a cross-platform remote access trojan (RAT). When installed, the script contacts a remote C2 server to deliver second-stage payloads for macOS, Windows, and Linux, then deletes itself and replaces its package.json with a clean decoy to hinder forensic analysis. This package was injected as a hidden dependency into the compromised axios releases 1.14.1 and 0.30.4. Users of plain-crypto-js 4.2.1 or axios 1.14.1 and 0.30.4 are advised to treat affected systems as fully compromised. Axios users should pin to axios@1.14.0 (1.x) or axios@0.29.0 (0.x).

Publish Date: 2026-03-30

URL: MSC-2026-3522

CVSS 3 Score Details (9.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here