Elastic Details axios npm Supply-Chain Compromise Delivering Cross-Platform RAT
Summary
Elastic Security Labs details how a compromised axios maintainer account published backdoored npm releases that installed a cross-platform RAT via plain-crypto-js; its three variants shared C2 behavior, while a spoofed IE8 user-agent offers a detection signal.
Key points
- Elastic says an attacker compromised an axios maintainer account and published backdoored versions 1.14.1 and 0.30.4, tagged latest and legacy.
- The releases introduced [email protected], whose postinstall hook ran setup.js to download platform-specific implants from sfrclak[.]com:8000.
- The RAT had PowerShell, C++, and Python implementations for Windows, macOS, and Linux, sharing HTTP POST C2, Base64-encoded JSON, and a 60-second beacon interval.
- All variants used a spoofed IE8/Windows XP user-agent; Elastic identifies it as a detection signal, particularly on macOS and Linux.
- The dropper obfuscated strings with reversal, Base64, and XOR, then deleted setup.js and replaced the malicious package manifest.
- The Windows variant included Registry Run-key persistence and reflective .NET loading; the macOS and Linux variants dropped binaries to disk and executed them.
- Elastic filed a GitHub Security Advisory and published triage and detection rules. The article identifies [email protected] and [email protected] as the last legitimate versions in their respective release lines.
Article Details
- Attack Vectors
- Attackers gained control of an axios maintainer account and published malicious [email protected] and [email protected] releases.
- The compromised releases introduced [email protected], whose npm postinstall hook ran node setup.js and downloaded platform-specific RAT payloads.
- The dropper used string reversal, Base64 decoding, and a position-dependent XOR cipher to obfuscate its behavior.
- The RAT communicated with its C2 over HTTP POST using Base64-encoded JSON and a spoofed IE8/Windows XP User-Agent.
- The Windows implant used a Registry Run key and hidden batch file for persistence; its variants also supported command execution, binary delivery, and directory enumeration.
- The dropper removed setup.js and replaced the package manifest with a clean copy to erase evidence of the postinstall trigger.
- Defensive Notes
- Elastic identified [email protected] and [email protected] as malicious; the article identifies [email protected] and [email protected] as the last legitimate releases in their respective version lines.
- The spoofed IE8/Windows XP User-Agent is identified as a detection indicator, particularly on macOS and Linux hosts.
- Elastic Security Labs published triage and detection rules and filed a GitHub Security Advisory for the axios repository.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | C2 and payload-hosting domain used to serve stage-2 implants. |
ifstap@proton[.]me | Publisher email shown in registry metadata for the compromised axios releases. | |
| IPV4 | 142[.]11[.]206[.]73 | IPv4 address listed in the article's observables as associated with C2 traffic. |
| SHA256 | 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | SHA-256 hash identified for the Windows stage-2 payload. |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | SHA-256 hash identified for the macOS stage-2 payload. |
| SHA256 | fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | SHA-256 hash identified for the Linux stage-2 payload. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | C2 endpoint contacted by the dropper to obtain platform-specific stage-2 payloads. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe dropper concealed strings and behavior using reversal, Base64 decoding, and a position-dependent XOR cipher.T1055 · Process InjectionThe Windows variant used reflective .NET assembly loading for in-memory execution described as injection into cmd.exe.T1059.001 · PowerShellThe Windows implant used PowerShell to execute scripts and commands.T1059.002 · AppleScriptThe macOS implant used AppleScript through osascript to download or execute payloads and commands.T1059.004 · Unix ShellThe Linux implant could execute commands through a shell.T1059.006 · PythonThe Linux variant was implemented in Python and could run Python code through python3.T1059.007 · JavaScriptThe malicious package's postinstall hook executed JavaScript through node setup.js.T1070 · Indicator RemovalThe dropper deleted setup.js and replaced the malicious package manifest with a clean copy.T1071.001 · Web ProtocolsThe RAT used HTTP POST with Base64-encoded JSON for C2 communications.T1105 · Ingress Tool TransferThe postinstall dropper fetched platform-specific stage-2 implants from the C2 server.T1195 · Supply Chain CompromiseThe attacker compromised an axios maintainer account and published backdoored package releases.T1547.001 · Registry Run Keys / Startup FolderThe Windows variant established persistence with a Registry Run key and hidden batch file.
Threat Actors
Malware
Products
AxiosElastic Security Labs disclosed a supply-chain compromise of the widely used axios npm package in which a compromised maintainer account published backdoored versions that used a malicious plain-crypto-js postinstallplain-crypto-jsin which a compromised maintainer account published backdoored versions that used a malicious plain-crypto-js postinstall hook to download a cross-platform RAT.