Axios compromised dependency (on-premise)
A supply-chain compromise of the Axios library affected Informer 2025.2.12. This advisory is for self-hosted (on-premise) deployments. Informer Cloud customers should read Axios compromised dependency (Informer Cloud) instead.
This issue affects Informer deployments that were upgraded to 2025.2.12 before April 8th, 2026. Deployments running a version prior to 2025.2.12 are not affected.
Updated builds of the Windows installer and Docker image are available through the Installing Informer and Upgrading Informer guides.
What happened
On March 31, 2026, Axios (a JavaScript HTTP library Informer uses, with over 70 million weekly downloads) was found to have been injected with a malware dependency that deploys a second-stage remote access trojan on the target system. Background on the compromise is available from Microsoft Security.
On April 1st, 2026, Entrinsik released Informer 2025.2.12. Malware and vulnerability scans were run before the final build, and issues related to the compromised Axios library were detected and mitigated. However, an additional third-party dependency Informer uses included its own compromised version of Axios, which was not detected during internal scans.
Neither the Windows installer nor the Docker images perform that operation by default. See below for how to tell whether it ran on your system.
How to tell if you are affected
If the malicious postinstall script ran, a specific file is left on the filesystem:
| Operating system | File |
|---|---|
| Windows | %PROGRAMDATA%\wt.exe (usually C:\ProgramData\wt.exe) |
| Linux | /tmp/ld.py |
| Mac | /Library/Caches/com.apple.act.mond |
What to do
For any server running an affected deployment of 2025.2.12, we strongly recommend one of:
- Restore the server (from a snapshot) to a point in time before 2025.2.12 was deployed, or
- Take the server offline and scan it for threats using up-to-date virus definitions.
We also strongly recommend rotating any passwords or secrets that would have been available to the user running the installer or the Informer service.
For the detailed technical analysis, see Axios incident root cause analysis.