KB-2376 Information about the Axios Supply Chain Compromise

Kaushal Patel — Wed, 01 Apr 2026 20:38:57 GMT

Current Revision posted to Appian Knowledge Base by Kaushal Patel on 4/1/2026 8:38:57 PM

On 31 March 2026, an Axios npm package that uses a JavaScript library to enable applications to make HTTP/S requests and is included as a dependency in millions of applications was compromised. Between ~00:21 and ~03:30 UTC, malicious versions (axios@1.14.1 and axios@0.30.4) were published using a compromised maintainer account.

Appian has investigated this vulnerability and affected services, and determined that it is not impacted, as no vulnerable versions of the packages are used in the Appian Cloud environment or any of Appian’s products. We will continue to monitor the situation and provide any updates as appropriate.

Supporting Documentation:

Affected Versions

This article applies to all supported versions of Appian.

Last reviewed: April 1, 2026

Tags: Security

KB-2376 Information about the Axios Supply Chain Compromise

Kaushal Patel — Wed, 01 Apr 2026 20:34:59 GMT

Revision 2 posted to Appian Knowledge Base by Kaushal Patel on 4/1/2026 8:34:59 PM

Supporting Documentation:

Affected Versions

This article applies to all supported versions of Appian.

Last reviewed: April 1, 2026

KB-XXXX Information about the Axios Supply Chain Compromise

Kaushal Patel — Wed, 01 Apr 2026 20:31:01 GMT

Revision 1 posted to Appian Knowledge Base by Kaushal Patel on 4/1/2026 8:31:01 PM

Supporting Documentation:

Affected Versions

This article applies to all supported versions of Appian.

Last reviewed: April 1, 2026