Security advisory and patch releases for kintone npm packages using compromised axios

kintoneSecurity

Following a compromise in the axios dependency of kintone npm packages, kintone issued an advisory and released version-pinned patches.

Required action

Users who may have installed the affected packages or run the affected commands during the incident window should check the official advisory and rotate their credentials.

Changes

  • Environments resolving 7 kintone npm packages between 9:21 and 12:15 JST on March 31, 2026 may have installed compromised axios@1.14.1 or axios@0.30.4.
  • Running @kintone/cli with plugin init --template typescript or @kintone/create-plugin with --template modern is also affected because it downloads @kintone/rest-api-client internally.
  • Starting an MCP server configured with npx @kintone/mcp-server may also be affected because it downloads the package at startup.
  • Patch versions pinning the axios dependency, including @kintone/rest-api-client 6.1.4 and @kintone/cli v1.19.2, were released as a preventive measure.

Affected areas

@kintone/rest-api-client@kintone/create-plugin@kintone/customize-uploader@kintone/dts-gen@kintone/webpack-plugin-kintone-plugin@kintone/cli@kintone/mcp-server

Open official page

This summary is independently created by Release Radar and is not an official announcement from the vendor. Please read the official page for accurate details.

More updates