Axios Supply-Chain Attack Deploys Cross-Platform RAT via Malicious npm Dependency
Summary
Unit 42 details how hijacked Axios npm releases installed plain-crypto-js, whose obfuscated dropper downloaded platform-specific RATs. Researchers report WAVESHAPER overlap and recommend package audits, credential rotation, system rebuilds and blocking C2 at sfrclak[.]
Key points
- Attackers used a hijacked Axios maintainer npm account to publish versions 1.14.1 and 0.30.4 containing the injected dependency plain-crypto-js.
- The dependency's npm postinstall hook ran an obfuscated Node.js dropper, setup.js, which used string reversal, Base64 decoding and XOR obfuscation.
- The dropper contacted sfrclak[.]com on port 8000 and fetched platform-specific RAT payloads for Windows, macOS and Linux.
- The RAT variants shared a command protocol, beaconed every 60 seconds and supported commands to run scripts, inject binaries, enumerate directories and terminate.
- The dropper removed its script and postinstall hook and replaced the modified package.json with a decoy after launching the payload.
- Unit 42 reports overlap with WAVESHAPER and activity previously linked to DPRK operations; this is reported overlap, not definitive attribution.
- Recommended actions include checking for affected packages and artifacts, isolating and rebuilding compromised systems, rotating accessible secrets, pinning safe Axios versions and blocking C2 traffic.
Article Details
- Attack Vectors
- Attackers hijacked an Axios maintainer’s npm account and published compromised Axios versions 1.14.1 and 0.30.4 with plain-crypto-js as a runtime dependency.
- Installing a compromised package triggered npm’s postinstall hook to execute the obfuscated Node.js dropper setup.js.
- The dropper contacted C2 infrastructure and downloaded a platform-specific RAT payload for Windows, macOS, or Linux.
- The RAT variants beaconed to C2 over HTTP POST, accepted commands to run scripts, drop and execute binaries, enumerate directories, or terminate, and included Windows registry Run-key persistence.
- After launching the payload, the dropper deleted setup.js, removed the postinstall hook, and replaced the tampered package.json with a decoy package.md.
- Defensive Notes
- Audit projects and node_modules for Axios 1.14.1 or 0.30.4 and plain-crypto-js versions 4.2.0 or 4.2.1; inspect for the platform-specific file artifacts listed in the article.
- Isolate affected systems and rebuild compromised environments from a known-good state rather than attempting cleanup in place.
- Clear npm, yarn, and pnpm caches; downgrade and pin Axios to 1.14.0 or 0.30.3, use dependency overrides, and restrict corporate repositories to known-good versions.
- Block egress to sfrclak[.]com and 142.11.206[.]73; monitor port 8000, anomalous HTTP POST requests, and beaconing.
- Review CI/CD logs, pause and validate deployments, and consider using the --ignore-scripts flag during automated installations.
- Assume secrets accessible to a system where the package executed may be compromised; rotate exposed credentials, tokens, keys, and CI/CD secrets.
- Use isolated development environments, store secrets in secure vaults or OS keychains, and deploy endpoint detection and response.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | callnrwise[.]com | Domain listed by Unit 42 as command-and-control infrastructure associated with the attack. |
| DOMAIN | sfrclak[.]com | C2 domain contacted by the dropper to retrieve platform-specific payloads. |
| IPV4 | 142[.]11[.]206[.]73 | C2 IP address identified by Unit 42 for the attack. |
| SHA256 | 01c9484abc948daa525516464785009d1e7a63ffd6012b9e85b56477acc3e624 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 0d83030ab8bfba675fc1661f0756b6770be7dd80b1b718de3d68a01f2e79a5f4 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 20df0909a3a0ef26d74ae139763a380e49f77207aa1108d4640d8b6f14cab8ca | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 4465bdeaddc8c049a67a3d5ec105b2f07dae72fa080166e51b8f487516eb8d07 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 526ab39d1f56732e4e926715aaa797feb13b1ae86882ec570a4d292e7fdc3699 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 5b5fbc627502c5797d97b206b6dcf537889e6bea6d4e81a835e103e311690e22 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 5e2ab672c3f98f21925bd26d9a9bba036b67d84fde0dfdbe2cf9b85b170cab71 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 7b47ed28e84437aee64ffe9770d315c1b984135105f7f608a8b9579517bc0695 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 8449341ddc3f7fcc2547639e21e704400ca6a8a6841ae74e57c04445b1276a10 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | 9c64f1c7eba080b4e5ff17369ddcd00b9fe2d47dacdc61444b4cbfebb23a166c | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | a224dd73b7ed33e0bf6a2ea340c8f8859dfa9ec5736afa8baea6225bf066b248 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | a98e04dec3a7fe507eb30c72da808bad60bc14d9d80f9770ec99c438faa85a1a | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | ad8ba560ae5c4af4758bc68cc6dcf43bae0e0bbf9da680a8dc60a9ef78e22ff7 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | cdc05cd30eb53315dadb081a7b942bb876f0d252d20e8ed4d2f36be79ee691fa | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| SHA256 | fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | SHA-256 hash listed by Unit 42 among malicious payload and installer hashes. |
| URL | hxxp[:]//sfrclak[.]com:8000 | C2 URL used by the dropper to communicate with attacker infrastructure. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | Specific C2 resource used by the dropper to fetch stage-two payloads. |
MITRE ATT&CK
T1027 · Obfuscated Files or Informationsetup.js used string reversal, Base64 decoding, and an XOR cipher with the key OrDeR_7077 to obfuscate its operations.T1059.001 · PowerShellThe Windows RAT included a PowerShell script that was fetched and executed by the dropper.T1059.006 · PythonThe Linux payload was a Python RAT script downloaded to /tmp/ld.py and run in the background.T1059.007 · JavaScriptThe compromised package’s postinstall hook executed the obfuscated Node.js dropper setup.js.T1070.004 · File DeletionAfter launching the payload, the dropper deleted setup.js as part of its forensic cleanup.T1071.001 · Web ProtocolsThe RAT variants beaconed every 60 seconds and exchanged Base64-encoded JSON over HTTP POST.T1105 · Ingress Tool TransferThe dropper sent an HTTP POST to sfrclak[.]com:8000 and fetched platform-specific RAT payloads.T1547.001 · Registry Run Keys / Startup FolderThe Windows RAT established persistence using a registry Run key.
Malware
Vendors
Products
Advanced WildFirePalo Alto Networks product protections (Advanced WildFire, Cortex XDR, XSIAM, Cortex Cloud) and Unit 42 incident response services were highlighted as available defenses and response options.AxiosPalo Alto Networks Unit 42 discovered that attackers hijacked an Axios maintainer’s npm account to publish compromised Axios versions v1.14.1 and v0.30.4 which injected the malicious dependency plain-crypto-js (versionsCortex CloudPalo Alto Networks product protections (Advanced WildFire, Cortex XDR, XSIAM, Cortex Cloud) and Unit 42 incident response services were highlighted as available defenses and response options.Cortex XDRPalo Alto Networks product protections (Advanced WildFire, Cortex XDR, XSIAM, Cortex Cloud) and Unit 42 incident response services were highlighted as available defenses and response options.XSIAMPalo Alto Networks product protections (Advanced WildFire, Cortex XDR, XSIAM, Cortex Cloud) and Unit 42 incident response services were highlighted as available defenses and response options.