eSentire Reports 19 Customers Affected by Axios npm Supply-Chain Attack
Summary
eSentire says two compromised Axios npm releases delivered SILKBELL and the WAVESHAPER RAT across Windows, macOS and Linux. It identified 19 affected customers; UNC1069 attribution is reported, and follow-on activity remains unconfirmed.
Key points
- Two backdoored Axios releases, published through a compromised maintainer account, were available for about three hours.
- A malicious dependency, [email protected], used a postinstall hook to run SILKBELL, which downloaded a cross-platform RAT tracked as WAVESHAPER.
- The RAT used platform-specific execution and persistence methods, including a disguised PowerShell binary and registry Run key on Windows, a Mach-O payload on macOS, and a Python backdoor on Linux.
- The RAT beaconed to command-and-control infrastructure over port 8000 every 60 seconds and supported commands for process termination, PE injection, script execution, and directory enumeration.
- eSentire reported validating cases affecting 19 customers, primarily in the software industry across North America and EMEA. The earliest observed infection occurred minutes after a malicious release.
- eSentire did not observe the Linux payload on monitored hosts; it reported no identified follow-on activity, and the cause of C2 connection issues was unknown.
- Recommended defenses include pinning package versions, disabling automated dependency upgrades, adding package-release cooldowns, and maintaining endpoint monitoring and threat hunting.
Article Details
- Attack Vectors
- A compromised maintainer account was used to publish two tampered Axios npm releases that added the malicious dependency [email protected].
- The dependency's postinstall hook executed setup.js, tracked as SILKBELL, which downloaded the WAVESHAPER RAT from attacker-controlled infrastructure.
- The RAT used platform-specific execution and persistence: disguised PowerShell and a registry Run key on Windows, a Mach-O payload launched with zsh on macOS, and a Python backdoor launched with nohup on Linux.
- The RAT beaconed to its C2 over port 8000 every 60 seconds, using a spoofed Internet Explorer 8 User-Agent, and supported script execution, PE injection, directory enumeration, and process termination.
- Defensive Notes
- Pin exact package versions and disable automated dependency upgrades.
- Use package release cooldowns, such as a seven-day minimum release age, with carefully controlled exclusion lists.
- Sandbox developer environments and maintain continuous endpoint monitoring and active threat hunting.
- Investigate endpoint indicators including renamed PowerShell processes masquerading as wt.exe, unexpected file ingress, and the macOS payload path /Library/Caches/com.apple.act.mond.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | callnrwise[.]com | Domain identified by the article as suspected C2. |
| DOMAIN | sfrclak[.]com | C2 domain hosting the WaveShaper endpoint. |
| IPV4 | 142[.]11[.]206[.]73 | WaveShaper C2 address identified in the article. |
| SHA256 | 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668 | Hash listed among malicious artifacts associated with the compromised packages. |
| SHA256 | 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd | Hash listed among artifacts associated with the tampered axios-1.14.1.tgz package. |
| SHA256 | 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | Hash identified for the Windows RAT payload. |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | Hash identified for the macOS RAT payload. |
| SHA256 | e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 | Hash of setup.js, the SILKBELL first-stage payload. |
| SHA256 | fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | Hash identified for the Linux RAT payload. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | WaveShaper C2 endpoint identified in the article. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe Windows malware copied powershell.exe to %PROGRAMDATA%wt.exe to masquerade as Windows Terminal.T1055 · Process InjectionThe RAT's peinject handler loaded a .NET injector in memory to inject shellcode or a PE into a host process.T1059.001 · PowerShellOn Windows, the malware executed a downloaded PowerShell payload using a disguised wt.exe with execution-policy bypass flags.T1059.002 · AppleScriptOn macOS, the script used AppleScript as part of fetching and launching the Mach-O payload.T1059.004 · Unix ShellOn macOS and Linux, the malware used zsh or shell commands to launch downloaded payloads.T1059.005 · Visual BasicThe Windows delivery path used a hidden VBScript to download the PowerShell payload.T1071.001 · Web ProtocolsThe RAT beaconed to its C2 over port 8000 at 60-second intervals using a spoofed Internet Explorer 8 User-Agent.T1083 · File and Directory DiscoveryThe RAT's rundir command enumerated filesystem paths and returned metadata.T1105 · Ingress Tool TransferSILKBELL connected to attacker-controlled infrastructure to download the WAVESHAPER RAT.T1195 · Supply Chain CompromiseThe attackers published tampered Axios releases that added a malicious dependency with a postinstall hook.T1547.001 · Registry Run Keys / Startup FolderThe Windows malware established persistence with a registry Run key and a hidden system.bat file.
People
Threat Actors
Sapphire SleetThe article identifies Sapphire Sleet as an alternate name for UNC1069, which it says multiple analysts attributed with the supply-chain campaign.STARDUST CHOLLIMAThe article identifies STARDUST CHOLLIMA as an alternate name for UNC1069, which it says multiple analysts attributed with the supply-chain campaign.UNC1069The supply-chain campaign is attributed to UNC1069 by multiple analysts; the article also identifies Sapphire Sleet and STARDUST CHOLLIMA as alternate names.
Malware
SILKBELLThe campaign, attributed to UNC1069, deployed SILKBELL to fetch the WAVESHAPER RAT and led to detections across Windows and macOS with 19 affected eSentire customers;WAVESHAPERThe campaign, attributed to UNC1069, deployed SILKBELL to fetch the WAVESHAPER RAT and led to detections across Windows and macOS with 19 affected eSentire customers;WAVESHAPER.V2SILKBELL subsequently connects to attacker-controlled infrastructure to download the cross-platform RAT, which Mandiant tracks as WAVESHAPER.V2 and CrowdStrike tracks as ZshBucket.ZshBucketSILKBELL subsequently connects to attacker-controlled infrastructure to download the cross-platform RAT, which Mandiant tracks as WAVESHAPER.V2 and CrowdStrike tracks as ZshBucket.
Vendors
Products
AxiosTwo backdoored Axios npm releases ([email protected] and [email protected]) were published from a compromised maintainer account and, during a roughly threeâhour window, introduced a malicious dependency thatnpmTwo backdoored Axios npm releases ([email protected] and [email protected]) were published from a compromised maintainer account and, during a roughly threeâhour window, introduced a malicious dependency that