AI-Assisted Monitor Flags Malicious Axios npm Releases
Summary
An Elastic engineer says an AI-assisted package-release monitor flagged malicious Axios npm releases that used a phantom dependency and postinstall hook to deploy malware. The article describes the response and recommends package monitoring and release delays.
Key points
- The author’s proof of concept monitors PyPI and npm releases, diffs package versions, uses an LLM to classify changes, and alerts through Slack; it downloads packages without installing or executing them.
- The monitor flagged Axios versions 1.14.1 and 0.30.4, which the article says were published after attackers took over a maintainer’s npm account.
- The malicious releases added the phantom dependency plain-crypto-js, whose postinstall hook deployed cross-platform malware.
- The author says Elastic Defend had already alerted on a host that installed a malicious package, and Axios maintainers quickly removed the releases.
- The article links the incident to a wider campaign attributed to TeamPCP; attribution of the Axios attack to a DPRK actor is described as suspected, not confirmed.
- Recommended measures include monitoring package changes, rotating credentials faster after breaches, and delaying adoption of new releases with package-manager soak-time settings.
- The open-source monitor is presented as a proof of concept with limitations: it requires a Cursor subscription, processes releases sequentially, and uses static watchlists.
Article Details
- Event Type
- npm supply-chain compromise involving malicious Axios releases
- Impact
- Two malicious Axios versions, 1.14.1 and 0.30.4, added the phantom dependency plain-crypto-js, whose postinstall hook deployed cross-platform malware. Elastic telemetry identified affected organizations and a host that had installed the package. The article describes the Axios attribution as suspected, while linking earlier Trivy, LiteLLM, and Telnyx compromises to TeamPCP.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//www[.]npmjs[.]com/package/axios/v/0.30.4 | Specific npm package-version URL identified in the article as a malicious Axios release. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article reports base64 obfuscation in malicious code and payloads.T1027.005 · Indicator Removal from ToolsThe Telnyx compromise used payloads hidden inside WAV audio files, as steganography.T1041 · Exfiltration Over C2 ChannelThe article reports malware exfiltrating data to a hardcoded C2 server.T1059 · Command and Scripting InterpreterThe malicious dependency used an npm postinstall lifecycle hook to execute the payload.T1078 · Valid AccountsAttackers reportedly compromised an npm maintainer account and changed its email address before publishing malicious releases.T1195.002 · Compromise Software Supply ChainAttackers added the phantom dependency plain-crypto-js to compromised Axios releases; its postinstall hook deployed malware.
Threat Actors
Vendors
Products
AxiosThe author built a proof-of-concept AI-driven monitor that diffs package releases and flagged a malicious npm compromise of Axios that used a phantom dependency with a postinstall hook to deploy cross-platform malware.Elastic DefendIt turns out that when I contacted them, they had already received Elastic Defend alerts on a host that had installed the malicious package and were actively responding.LiteLLMThe incident ties into a wider supply-chain campaign (Trivy â LiteLLM â Telnyx â Axios) attributed to TeamPCP, prompting coordinated detection, takedown, and recommendations for registry monitoring and releaseTelnyxThe incident ties into a wider supply-chain campaign (Trivy â LiteLLM â Telnyx â Axios) attributed to TeamPCP, prompting coordinated detection, takedown, and recommendations for registry monitoring and releaseTrivyThe incident ties into a wider supply-chain campaign (Trivy â LiteLLM â Telnyx â Axios) attributed to TeamPCP, prompting coordinated detection, takedown, and recommendations for registry monitoring and release
Tools
CursorThe author created supply-chain-monitor, a PoC that diffs package releases and uses an LLM (via Cursor) to classify changes as malicious or benign.supply-chain-monitorThe author created supply-chain-monitor, a PoC that diffs package releases and uses an LLM (via Cursor) to classify changes as malicious or benign.