Skip to main content

Axios compromised dependency (Informer Cloud)

This advisory covers the 2025.2.12 Axios supply-chain incident as it relates to Informer Cloud. For self-hosted deployments, see Axios compromised dependency (on-premise). The following was included in an email to the technical contacts listed for Cloud customers.

As part of our ongoing commitment to transparency, privacy, and security, we are notifying you that we identified a vulnerable library that was briefly included in Docker images used for testing in Informer Cloud.

Summary of findings​

An audit of our builds found that, between March 31st and April 2nd, a test version of our 2025.2.12 release included a vulnerable version of the Axios library (1.14.1) and was deployed in our EA environment and in a dry-run of the 2025.2.12 upgrade. The malicious code connects to a remote command-and-control network to request remote code to execute. In Linux environments like our images, it also leaves a Python script in the /tmp directory that it attempts to continuously execute.

Investigation results​

After reviewing the nature of the attack and auditing the network traffic of the compromised image, we found no evidence that attackers were ever able to execute any commands in our cloud environment. No requests to the attackers' command-and-control servers were detected. The nature of our SaaS environment prevented the attackers' phone-home code or Python script from ever executing once the image was deployed. No anomalous processes were found during the audit, a strong indicator that the attackers were never able to persist any malicious code after the build process. Builds run in a completely isolated environment where no secrets would have been exposed.

There is no evidence that any malicious commands or traffic resulted from this incident. Out of an abundance of caution, we recommend these precautions:

  1. Rotate any Datasource or Domain secrets stored in Informer Cloud. User passwords are stored as salted hashes and cannot be recovered even in the event of compromise, but it is still best practice to rotate them as well.
  2. Monitor your Datasources for unauthorized access from unfamiliar IP addresses. Legitimate Informer Cloud traffic's source IP address is 52.1.147.31 from the wider Internet and 172.29.86.1 from our Wireguard VPN. If you use SSH tunnels, legitimate traffic appears to come from your intermediary machine.

We found no evidence that visiting Informer Cloud while the vulnerable code was live could spread malware to customer machines.

Ongoing commitment​

We have taken steps to ensure this dependency is removed from all future build pipelines and that our Software Composition Analysis (SCA) scanning is updated to prevent recurrence. For technical background on the vulnerability, we recommend: