Axios 套件安全入侵事件：Vercel 發布緊急修復與防範指引

### Incident Overview On March 31, 2026, Vercel issued an emergency security advisory warning that **Axios**, a widely-used JavaScript HTTP client library, had suffered a package compromise. Because Axios is an extremely core dependency in modern web development and the Node.js ecosystem, this incident drew significant attention from the developer community. Vercel provided detailed impact information and remediation guidance to ensure the security of projects hosted on the Vercel platform. ### What Is a Package Compromise? In the software supply chain, a package compromise typically means a malicious third party has gained publishing access to an official npm package through some means — such as stealing a developer's account credentials, leaking secrets, or hijacking a dependency — and has uploaded a version containing malicious code. Once developers unknowingly install or update to one of these tainted versions, the malicious code can be executed during the project's build phase or at server runtime. ### Potential Threats to Vercel Projects If your Vercel project uses an affected version of Axios, you may face the following risks: 1. **Credential and Environment Variable Leakage**: Malicious scripts may read environment variables in your Vercel project (such as database passwords, third-party API keys, Stripe secrets, etc.) and transmit them to external malicious servers. 2. **Server-Side Remote Code Execution (RCE)**: When Vercel Serverless Functions or Edge Functions run, malicious code may be triggered, causing abnormal service behavior. 3. **Client-Side Browser Contamination**: If Axios is bundled into frontend code, end users' browsers may execute malicious scripts, leading to user data leakage or phishing attacks. ### Official Remediation and Prevention Steps To ensure your project is secure, Vercel recommends all developers immediately take the following steps: 1. **Check Project Dependencies (Lockfiles)** Immediately check the `package.json` in your project root, along with the corresponding lock file (such as `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml`), to confirm which version of Axios your project is currently using. 2. **Run a Security Audit and Update** Use your package manager's built-in security audit feature to detect and fix vulnerabilities: - If using npm: run `npm audit` and follow the recommendations with `npm update axios`. - If using Yarn: run `yarn audit`. - If using pnpm: run `pnpm audit`. Make sure to force-update Axios to the latest version officially confirmed as safe. 3. **Clear Vercel Cache and Redeploy** After updating your local dependency files and pushing them to the Git repository, be sure to **Redeploy** in the Vercel console and select **"Redeploy with clean cache"** to ensure no cached remnants of any old malicious packages remain on Vercel's build servers. 4. **Rotate Credentials** If you have confirmed that your project was ever deployed with an affected version of Axios, it is strongly recommended that you immediately rotate all sensitive environment variables and API keys used in that project, in case credentials have already been stolen by a malicious third party.