Compromised Axios npm Releases Deliver Trojanized Dependency and RAT
Summary
Socket traced compromised Axios releases 1.14.1 and 0.30.4 to [email protected], whose postinstall dropper delivers platform-specific payloads. Analysis of the macOS RAT found command execution, host-data collection and persistence capabilities.
Key points
- Axios versions 1.14.1 and 0.30.4 included the malicious dependency [email protected]; projects using matching caret ranges could resolve the compromised releases.
- The dependency's postinstall hook runs an obfuscated setup.js dropper that fetches platform-specific payloads and removes files to hide evidence of installation.
- The macOS Mach-O RAT fingerprints hosts, beacons to sfrclak[.]com, and supports command execution, binary injection and filesystem enumeration.
- Windows delivery renames PowerShell and uses hidden scripts; Linux delivery downloads and runs a Python payload.
- Socket also identified the same malware in @shadanai/openclaw and @qqbrowser/[email protected].
- Recommended steps include checking dependencies, lockfiles, branches and pull requests; removing or rolling back affected versions; revoking long-lived npm tokens; and tightening publishing controls.
Article Details
- Attack Vectors
- Compromised Axios releases [email protected] and [email protected] added the trojanized dependency [email protected], which runs setup.js through an npm postinstall hook.
- The dropper downloads platform-specific payloads from a C2 server for macOS, Windows, and Linux.
- The macOS payload is a RAT that fingerprints hosts, beacons over HTTP POST, executes commands, can inject additional binaries, and collects system data.
- The malware uses encoded strings to obscure its C2 URL, commands, module names, and file paths, then deletes or replaces package files to conceal the postinstall hook.
- Additional affected packages reported in the article are @shadanai/openclaw and @qqbrowser/[email protected].
- Defensive Notes
- Check dependency manifests, lockfiles, feature branches, and open pull requests for [email protected], [email protected], and [email protected].
- Remove affected versions or roll back to known-good versions.
- Revoke long-lived npm tokens and tighten package publishing controls.
- Inspect systems for the described platform-specific payload artifacts and investigate network traffic to the reported C2 indicators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | Reported C2 domain used by the dropper and macOS RAT. |
| IPV4 | 142[.]11[.]206[.]73 | Reported IP address for the C2 infrastructure. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | Reported C2 endpoint used for beaconing and payload delivery. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe dropper hides strings using reversed Base64 decoding followed by a custom XOR operation.T1036 · MasqueradingThe Windows payload renames a copy of powershell.exe to wt.exe, and the macOS binary uses a com.apple-style filename to appear legitimate.T1041 · Exfiltration Over C2 ChannelThe macOS RAT sends Base64-encoded host data to the C2.T1057 · Process DiscoveryThe RAT collects a listing of running processes during host fingerprinting.T1059.001 · PowerShellThe Windows payload executes a downloaded PowerShell script with hidden and execution-policy-bypass flags.T1059.002 · AppleScriptThe macOS dropper uses AppleScript to download and launch the payload.T1059.006 · PythonThe Linux payload is downloaded as /tmp/ld.py and run with python3.T1059.007 · JavaScriptThe npm postinstall hook runs the JavaScript dropper setup.js with Node.js.T1070.004 · File DeletionThe malware deletes setup.js and the malicious package.json, then renames package.md to package.json to conceal the postinstall hook.T1071.001 · Web ProtocolsThe RAT beacons to the C2 using HTTP POST requests.T1082 · System Information DiscoveryThe RAT fingerprints the system, collecting details including the OS version, CPU type, timezone, and boot time.T1083 · File and Directory DiscoveryThe RAT enumerates directories, including listings under /Applications and user Library paths.T1105 · Ingress Tool TransferThe dropper uses curl to download platform-specific scripts or binaries from the C2.T1195.001 · Compromise Software Dependencies and Development ToolsThe compromised Axios releases introduced [email protected] as a malicious software dependency.
People
Products
AxiosAttackers published compromised Axios releases ([email protected] and [email protected]) that introduced a trojanized dependency [email protected], which uses a postinstall dropper to deliver platform-specific payloads and aOpenClawTwo additional packages were found distributing the same trojan via vendored dependencies or vendored/tampered axios copies: @shadanai/openclaw and @qqbrowser/[email protected].plain-crypto-jscompromised Axios releases ([email protected] and [email protected]) that introduced a trojanized dependency [email protected], which uses a postinstall dropper to deliver platform-specific payloads and a macOS Mach-O RAT