SlowMist Flags Malicious axios 1.14.1 and 0.30.4, Warns of Risk from Global OpenClaw npm Installs

Odaily Planet Daily reported that, as of March 31, 2026, public threat intelligence has confirmed axios@1.14.1 and axios@0.30.4 as malicious releases. Both versions were modified to add an extra dependency, plaincryptojs@4.2.1, which delivers a cross-platform malicious payload through a postinstall script. SlowMist said the potential impact on OpenClaw depends on how the software was obtained and installed: 1) Building from source: No impact on v2026.3.28. The lock file pins axios@1.13.5 / 1.13.6, which are not the malicious versions. 2) Global install via npm (npm install -g openclaw@2026.3.28): Historical exposure risk. The dependency chain includes openclaw > @line/botsdk@10.6.0 > optionalDependencies.axios@^1.7.4, which could have resolved to axios@1.14.1 while the malicious release was available. 3) Reinstalling today: npm currently resolves axios@1.14.0. Systems installed during the attack window should still be treated as potentially compromised and checked for IoCs. SlowMist added that detecting a plaincryptojs directory should be treated as a high-risk execution trace even if the package.json inside it has been removed. Hosts that ran npm install or npm install -g openclaw@2026.3.28 during the attack window are advised to rotate credentials immediately and perform host-level investigations.