Critical, CVSS 9.6npmAmendedPublished
Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions
GHSA-3hfp-gqgh-xc5g
- Affected
- npm @lightdash/cli >= 0.1800.0, < 0.2695.1
- Fixed in
- 0.2695.1· Vendor fix available
- Issue
- Impact A supply chain attack on the axios npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency (plain-crypto-js@4.2.1) that deploys a cross-platform remote access trojan (RAT) on macOS, Windows, and Linux. The attacker compromised the primary axios maintainer's npm account to publish the malicious versions. The malicious versions were live on npm for approximately 3 hours (00:21 UTC to 03:29 UTC on March 31, 2026) before being removed. The @lightdash/cli package specified axios as a dependency with a semver range (^1.12.0) that permitted resolution to the compromised version. Any user who performed a fresh install of @lightdash/cli versions = 0.1800.0, < 0.2695.1 (without a pre-existing lockfile) during this window may have installed the malicious axios version. If compromised, the RAT establishes a connection to a command-and-control server (sfrclak[.]com / 142.11.206.73:8000) and provides the attacker with shell access, file system enumeration, and…
Recommended action: Upgrade to 0.2695.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.