Malicious Axios npm Releases Deliver Sapphire Sleet RATs Across Three Operating Systems
Summary
Microsoft reports that malicious Axios releases 1.14.1 and 0.30.4 added a post-install dependency that fetched OS-specific RATs from a Sapphire Sleet C2. The investigation details the attack chain, Defender protections, and remediation.
Key points
- Released March 31, 2026, Axios versions 1.14.1 and 0.30.4 added the malicious runtime dependency [email protected].
- The dependency’s post-install script silently fetched a second-stage payload during npm installation or updates, potentially affecting developer machines and CI/CD systems.
- Microsoft describes a shared C2 endpoint, hxxp://sfrclak[.]com:8000/6202033, serving platform-specific payloads for Windows, macOS, and Linux.
- The reported payloads included a Windows PowerShell RAT with a registry run-key persistence mechanism, a macOS binary, and a Linux Python loader.
- The installer removed its loader and replaced the manifest after execution, making post-incident inspection more difficult.
- Microsoft says it disabled the account associated with the malicious dependency and added Defender protections. Recommended steps include downgrading to safe Axios versions, pinning dependencies, checking systems and CI/CD logs, and rotating exposed credentials.
Article Details
- Attack Vectors
- Two malicious Axios releases, [email protected] and [email protected], added the fake runtime dependency [email protected].
- The dependency's npm post-install hook ran node setup.js during installation, without additional user interaction, and downloaded an OS-specific second-stage payload.
- The loader used obfuscated strings and HTTP POST requests to the same C2 URL, with platform identifiers in the POST body for macOS, Windows, and Linux.
- The Windows payload created a registry run key for persistence, collected system information, and supported remote PowerShell commands and additional payload execution.
- After launching the payload, installer logic deleted setup.js and the original package manifest, then replaced the manifest with a clean-looking one.
- Defensive Notes
- Roll back affected Axios versions to 1.14.0 or 0.30.3 or earlier, pin exact versions, and use overrides to constrain transitive dependencies.
- Review CI/CD logs and developer machines for [email protected], [email protected], and [email protected]; investigate connections to sfrclak[.]com or 142.11.206[.]73 on port 8000.
- Rotate secrets and credentials exposed to affected systems, remove compromised files, and reinstall cleanly.
- Clean the npm cache and, where feasible, disable or restrict post-install scripts, automated dependency updates, and dependency bots for critical packages.
- Microsoft recommends adopting Trusted Publishing with OIDC and notes that Microsoft Defender detections and network protections block or alert on components and indicators from the attack.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | C2 domain reported as controlled by Sapphire Sleet and used to serve second-stage payloads. |
| IPV4 | 142[.]11[.]206[.]73 | IP address identified as the Sapphire Sleet C2 server associated with the malicious Axios packages. |
| SHA256 | 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | Additional SHA-256 reported for the malicious Windows PowerShell payload. |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | SHA-256 of the malicious macOS binary saved as /Library/Caches/com.apple.act.mond. |
| SHA256 | ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c | SHA-256 reported for the malicious Windows PowerShell payload 6202033.ps1. |
| SHA256 | f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd | SHA-256 of the Windows system.bat file created by the PowerShell payload. |
| SHA256 | fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | SHA-256 of the malicious Linux Python payload ld.py. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | C2 URL used by the post-install loader to retrieve platform-specific payloads and for subsequent RAT communications. |
MITRE ATT&CK
T1027 · Obfuscated Files or Informationsetup.js used layered obfuscation to reconstruct module names, paths, platform identifiers, and command templates at runtime.T1036.005 · Match Legitimate Resource Name or LocationThe Windows payload was copied and renamed to wt.exe, and the macOS binary used the Apple-like name com.apple.act.mond.T1059 · Command and Scripting InterpreterThe attack used Node.js, PowerShell, AppleScript, Python, VBScript, and shell commands to launch and execute payloads.T1070.004 · File DeletionInstaller logic deleted setup.js and the manifest containing the install trigger after launching the second-stage payload.T1071.001 · Web ProtocolsThe malware used HTTP POST requests to the C2 URL for payload retrieval and RAT communications.T1082 · System Information DiscoveryThe Windows RAT collected OS, boot-time, hardware, and running-process information to generate a host identifier and inventory.T1105 · Ingress Tool TransferThe post-install loader downloaded OS-specific second-stage payloads from the attacker-controlled C2.T1195 · Supply Chain CompromiseThe malicious Axios releases inserted [email protected] to trigger downstream execution during package installation.T1547.001 · Registry Run Keys / Startup FolderThe Windows RAT created an HKCU Run key to re-fetch the RAT after sign-in or reboot.
Threat Actors
Vendors
HostwindsThe associated IP address (142.11.206[.]73) is tied to Hostwinds, a virtual private server (VPS) provider that Sapphire Sleet is known to commonly use when establishing C2.MicrosoftMicrosoft Defender detections blocked and alerted on multiple stages; Microsoft disabled the publisher account for the malicious plain-crypto-js package and added protections and hunting queries for affected customers.
Products
AxiosTwo malicious Axios npm releases ([email protected] and [email protected]) injected a runtime dependency [email protected] that executed a post-install hook to download OS-specific RAT payloads from a SapphireMicrosoft Defender Antimalware PlatformMicrosoft Defender detections blocked and alerted on multiple stages; Microsoft disabled the publisher account for the malicious plain-crypto-js package and added protections and hunting queries for affected customers.Node.jsInstalled Node.js packages with malicious versionsnpmTwo malicious Axios npm releases ([email protected] and [email protected]) injected a runtime dependency [email protected] that executed a post-install hook to download OS-specific RAT payloads from a Sapphireplain-crypto-jsTwo malicious Axios npm releases ([email protected] and [email protected]) injected a runtime dependency [email protected] that executed a post-install hook to download OS-specific RAT payloads from a Sapphire
Countries
Industries
BlockchainThe threat actor focuses primarily on the finance sector, including cryptocurrency, venture capital, and blockchain organizations.CryptocurrencyThe threat actor focuses primarily on the finance sector, including cryptocurrency, venture capital, and blockchain organizations.financeThe threat actor focuses primarily on the finance sector, including cryptocurrency, venture capital, and blockchain organizations.Venture capitalThe threat actor focuses primarily on the finance sector, including cryptocurrency, venture capital, and blockchain organizations.