GTIG Details Axios Supply-Chain Attack Delivering WAVESHAPER.V2 Backdoor
Summary
GTIG reports that a malicious dependency added to two axios releases on March 31, 2026, delivered the SILKBELL dropper and WAVESHAPER.V2 backdoor across Windows, macOS and Linux; it attributes the campaign to UNC1069 and recommends containment and credential rotation.
Key points
- GTIG says an axios maintainer account was compromised and plain-crypto-js 4.2.1 was added to axios releases 1.14.1 and 0.30.4 on March 31, 2026.
- The malicious package’s NPM postinstall hook runs the obfuscated SILKBELL JavaScript dropper, which attempts to delete itself and restore package.json after deploying a payload.
- The dropper delivers WAVESHAPER.V2 variants for Windows, macOS and Linux. The backdoor collects system information, enumerates directories and supports remote command and payload execution.
- The Windows branch establishes persistence through a Run key; the macOS branch stages a Mach-O binary, while the Linux branch downloads a Python backdoor.
- WAVESHAPER.V2 beacons over HTTP on port 8000 every 60 seconds. GTIG links the activity to UNC1069 based on malware lineage and infrastructure overlaps, including sfrclak[.]com and 142.11.206.73.
- GTIG advises auditing for affected axios versions and plain-crypto-js, isolating affected hosts, pinning known-good versions, blocking the reported infrastructure and rotating potentially exposed credentials.
Article Details
- Attack Vectors
- An attacker compromised an axios maintainer account and introduced the malicious plain-crypto-js dependency into axios releases 1.14.1 and 0.30.4 on March 31, 2026.
- Installing the compromised package triggered an obfuscated JavaScript dropper through the dependency's NPM postinstall hook.
- The dropper used HTTP requests to retrieve OS-specific payloads: a PowerShell script on Windows, a Mach-O binary on macOS, and a Python backdoor on Linux.
- WAVESHAPER.V2 beaconed to attacker infrastructure over HTTP on port 8000 and polled for commands, including script execution, directory enumeration, and PE injection.
- On Windows, WAVESHAPER.V2 established logon persistence with a hidden batch file and an HKCU Run key.
- Defensive Notes
- Avoid axios versions 1.14.1 and 0.30.4; pin dependencies to known-good versions and audit lockfiles for plain-crypto-js versions 4.2.0 and 4.2.1.
- If plain-crypto-js is detected, treat the host as compromised, isolate it, restore a known-good environment, and rotate credentials and secrets present on the machine.
- Block traffic to sfrclak[.]com and 142.11.206.73, and monitor endpoints for communication attempts to that infrastructure.
- Pause CI/CD deployments that rely on axios until builds are verified to use pinned, safe versions; clear npm, yarn, and pnpm caches to reduce reinfection risk.
- Use EDR to monitor for suspicious processes spawned by Node.js applications, and isolate development environments to restrict host filesystem access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | C2 domain used by WAVESHAPER.V2 and to deliver platform-specific payloads. |
ifstap@proton[.]me | Attacker-controlled email address substituted for the compromised axios maintainer account. | |
| IPV4 | 142[.]11[.]206[.]73 | C2 IP address associated with WAVESHAPER.V2. |
| IPV4 | 23[.]254[.]167[.]216 | Infrastructure identified in the article as suspected UNC1069 infrastructure. |
| SHA256 | 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668 | Hash of the malicious plain-crypto-js-4.2.1.tgz package. |
| SHA256 | 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | Hash listed for the Windows Stage 1 payload. |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | Hash listed for the macOS native payload. |
| SHA256 | e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 | Hash of the SILKBELL setup.js dropper in the malicious package. |
| SHA256 | ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c | File hash included among the article's indicators for the attack. |
| SHA256 | f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd | Hash listed for the Windows persistence file system.bat. |
| SHA256 | fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | Hash listed for the WAVESHAPER.V2 Linux Python RAT. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | C2 and payload-delivery URL used by the dropper over port 8000. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationSILKBELL uses custom XOR and Base64 string obfuscation to conceal C2 URLs and execution commands.T1036.003 · Rename Legitimate UtilitiesThe Windows deployment copies powershell.exe to %PROGRAMDATA%wt.exe, renaming the legitimate executable.T1055.002 · Portable Executable InjectionWAVESHAPER.V2's peinject command supports in-memory PE injection.T1057 · Process DiscoveryThe backdoor collects detailed lists of running processes.T1059.001 · PowerShellThe Windows deployment retrieves and executes a PowerShell script.T1059.004 · Unix ShellThe macOS and Linux deployment paths use shell commands, including curl, chmod, and zsh, to retrieve and launch payloads.T1059.006 · PythonThe Linux branch downloads and executes a Python backdoor at /tmp/ld.py.T1059.007 · JavaScriptNPM's postinstall hook runs the setup.js JavaScript dropper with Node.js.T1070.004 · File DeletionThe dropper attempts to delete itself and restore package.json from package.md to remove traces.T1071.001 · Web ProtocolsWAVESHAPER.V2 communicates with its C2 over HTTP on port 8000 using Base64-encoded JSON beacons.T1082 · System Information DiscoveryWAVESHAPER.V2 collects host telemetry including hostname, username, boot time, time zone, and OS version.T1083 · File and Directory DiscoveryThe backdoor can return detailed listings and metadata for requested directories.T1105 · Ingress Tool TransferThe dropper retrieves platform-specific scripts and binaries from the C2 server.T1195.002 · Compromise Software Supply ChainThe attacker compromised an axios maintainer account and inserted the malicious plain-crypto-js dependency into package releases.T1547.001 · Registry Run Keys / Startup FolderOn Windows, the backdoor creates a hidden batch file and a MicrosoftUpdate entry under the HKCU Run key for logon persistence.
Threat Actors
TeamPCPThe article reports that UNC6780 poisoned GitHub Actions and PyPI packages associated with Trivy, Checkmarx, and LiteLLM to deploy SANDCLOCK and support follow-on extortion operations.UNC1069GTIG attributes the axios supply-chain attack to UNC1069 based on WAVESHAPER.V2 lineage and infrastructure overlap; the attribution is the article's assessment.
Malware
SANDCLOCKActions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.SILKBELLNPM package where a malicious dependency, plain-crypto-js (v4.2.1), delivered an obfuscated dropper (SILKBELL) that installed WAVESHAPER.V2 across Windows, macOS, and Linux.WAVESHAPERdependency, plain-crypto-js (v4.2.1), delivered an obfuscated dropper (SILKBELL) that installed WAVESHAPER.V2 across Windows, macOS, and Linux.WAVESHAPER.V2dependency, plain-crypto-js (v4.2.1), delivered an obfuscated dropper (SILKBELL) that installed WAVESHAPER.V2 across Windows, macOS, and Linux.
Products
AxiosGoogle Threat Intelligence Group (GTIG) observed a supply chain compromise of the axios NPM package where a malicious dependency, plain-crypto-js (v4.2.1), delivered an obfuscated dropper (SILKBELL) that installednpmGoogle Threat Intelligence Group (GTIG) observed a supply chain compromise of the axios NPM package where a malicious dependency, plain-crypto-js (v4.2.1), delivered an obfuscated dropper (SILKBELL) that installedplain-crypto-js(GTIG) observed a supply chain compromise of the axios NPM package where a malicious dependency, plain-crypto-js (v4.2.1), delivered an obfuscated dropper (SILKBELL) that installed WAVESHAPER.V2 across Windows,
Tools
aws-vaultDeveloper Sandboxing & Secret Vaulting: Isolate development environments in containers or sandboxes to restrict host filesystem access, and migrate plaintext secrets to the OS keychain using aws-vault.Google Security Operations (SecOps)Google Security Operations (SecOps) customers have access to the following broad category rules and more under the Mandiant Intel Emerging Threats rule pack.Open Source InsightsUse tools like Wiz or Open Source Insights for deeper dependency auditing.WizUse tools like Wiz or Open Source Insights for deeper dependency auditing.