Is It Dead Yet? dependency vitals

axiosnpm

Signals · last 2 checks

Commits 90d
100
Open issues
47
Unanswered
7
Contributors
40
What the project says about itself
  • Build provenance — the latest release, 1.20.0, carries a signed provenance attestation. Source: the registry.
  • Publishers on the registry — 1. Source: the registry.
  • Security policy — published. Source: the repository.
  • OpenSSF Scorecard — 8 / 10 on 2026-08-17. Source: OpenSSF, via deps.dev. A third party's view of security practice, not part of the health score.

Third-party facts checked yesterday; registry facts on every crawl.

State history 1
WhenChange
2026-09-03 first verdict: active
Supply-chain history 1

  1. account hijacked 2026-03 1.14.1, 0.30.4

    The lead maintainer was socially engineered through a fake workspace and call into installing a trojan; the attacker then published two versions that added a never-imported dependency whose post-install script dropped a remote-access tool.

    npm removed the packages about three hours later and revoked tokens; the maintainer published a post-mortem.

    Source: Datadog Security Labs analysis and the maintainer’s post-mortem, 31 March 2026. History, not a warning about today — the verdict above is about maintenance now.

Badge

maintenance: active

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/npm/axios.svg)](https://isitdeadyet.dev/npm/axios)

Watch it

Get told when axios changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.