Published · 1h agoSecurity2 min read
Five perfect scores, no advisory: the only countable five here is CISA's rotation list
The Cisco material supplied carries no CVE and no CVSS score. The five that is documented is CISA's list of secret classes to rotate after the Axios npm compromise.
Not a builder's beat, but builders have a standing stake in it.See today for builders
What happened
- CISA released an alert on the software supply chain compromise of the Axios npm package; Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments.
- On March 31, 2026, two npm packages for versions [email protected] and [email protected] injected the malicious dependency [email protected], which downloads multi-stage payloads from cyber threat actor infrastructure, including a remote access trojan.
- CISA recommends rotating or revoking credentials that may have been exposed on affected systems or pipelines, giving as examples version control system tokens, CI/CD secrets, cloud keys, npm tokens and SSH keys.
- CISA's exposed-credential examples name five distinct classes of secret.
- CISA states that for ephemeral CI jobs, organisations should rotate all secrets injected into the compromised run.
Compiled by The WatchSomething wrong?How this is made
Why it matters
The only five this material actually documents is a rotation list. CISA's Axios alert tells operators to rotate or revoke version control tokens, CI/CD secrets, cloud keys, npm tokens and SSH keys after a compromised install [3], and that enumeration runs to five items [4]. It is a count of blast radius, not of severity.
The radius is set by where the code runs. Axios is an HTTP client common to Node.js and browser code [1], and CISA's detection guidance points at install time: watch for unexpected child processes and anomalous network behaviour during npm install or npm update [20], and review the repositories, pipelines and developer machines that ran them [21]. Whatever those runs could read is what has to be rotated, which is why the agency adds that for ephemeral CI jobs, every secret injected into the compromised run counts [5].
That is where GitLab's token documentation stops being boilerplate and becomes the cost model. GitLab tells users to split scopes across separate tokens so that one leak grants less than full API access [14], and to avoid personal access tokens as CI/CD variables because of their breadth, preferring job tokens, then project tokens, then group tokens [13]. A pipeline built on a job token has a short rotation list. One built on a single wide personal access token has an incident.
The timing is worth arithmetic. The injection landed on March 31, 2026 [2]; Microsoft's mitigation writeup is dated April 1 [19]; CISA's own alert followed 20 days after the injection [10]. Against a one-day gap to public documentation, the min-release-age=7 setting CISA recommends [9] would have left six days of margin before either poisoned version became eligible to install [18].
As for Cisco, the documents in hand are onboarding procedure for Crosswork Network Controller 7.2 [15] and a Secure Workload overview that lists virtual patching and shutting down vulnerable management ports among its early wins [16]. Neither carries a CVE identifier, a CVSS score or an advisory [17]. The five 10.0s are a claim about something we were not sent.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CISA released an alert on the software supply chain compromise of the Axios npm package; Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments.
- [2]
On March 31, 2026, two npm packages for versions [email protected] and [email protected] injected the malicious dependency [email protected], which downloads multi-stage payloads from cyber threat actor infrastructure, including a remote access trojan.
- [3]
CISA recommends rotating or revoking credentials that may have been exposed on affected systems or pipelines, giving as examples version control system tokens, CI/CD secrets, cloud keys, npm tokens and SSH keys.
- [5]
CISA states that for ephemeral CI jobs, organisations should rotate all secrets injected into the compromised run.
- [6]
CISA's remediation instruction is to downgrade to [email protected] or [email protected] and delete node_modules/plain-crypto-js/.
- [7]
CISA advises blocking and monitoring outbound connections to Sfrclak[.]com domains, and conducting continuous indicator searches and EDR hunts to confirm no indicators of compromise remain and no further egress to command and control.
Sources & coverage · 3 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- docs.gitlab.com1h agoGitLab token overview | GitLab Docs
- cisco.com1h agoCisco Secure Workload At a Glance - Cisco
