Axios npm Supply Chain Compromise – Guidance for Azure Pipelines Customers

This post provides guidance to Azure Pipelines customers on mitigating the Axios npm supply chain compromise. It clarifies that Azure Pipelines itself was not compromised, but customer workflows using custom scripts, extensions, self-hosted agents, or containers could be at risk if they installed malicious Axios versions. Recommendations include reviewing self-hosted agents, auditing custom/third-party tasks, reviewing service connections, and clearing pipeline dependency caches. It also outlines best practices for reducing future supply chain risk, such as pinning dependency versions, using lockfiles, limiting secret scope, and rebuilding build outputs after remediation. Specific indicators of compromise like network activity to sfrclak[.]com or 142.11.206.73 are provided.