Malicious Axios npm Releases Deliver Cross-Platform RAT
Summary
Compromised Axios npm releases added a malicious dependency whose postinstall script downloaded platform-specific RATs. Developers whose install workflows ran the affected versions are advised to treat build machines as compromised and rotate secrets.
Key points
- The article says an attacker used compromised Axios maintainer credentials to publish [email protected] and [email protected], which added [email protected].
- A postinstall script downloaded an obfuscated dropper that retrieved RAT payloads for macOS, Windows, and Linux.
- The risk applies to install or build workflows that resolved the affected packages with scripts enabled; the article says ordinary browser use of apps built with Axios does not directly run the RAT.
- The article advises treating affected machines as potentially fully compromised and rotating exposed secrets, including cloud keys, deploy keys, and npm tokens.
- The dropper reportedly removes traces, so inspecting the installed dependency or running npm audit may not reveal the compromise. Listed indicators include sfrclak[.]com and 142.11.206.73.
Article Details
- Event Type
- npm supply-chain attack involving poisoned Axios packages published using compromised maintainer credentials
- Impact
- The reported malicious releases [email protected] and [email protected] added [email protected] and ran a postinstall script that downloaded a dropper and platform-specific RAT payloads. Environments that installed the affected versions with scripts enabled may have been compromised, with secrets potentially exposed. The article says the impact is primarily on install/build environments, not users merely loading apps in a browser, and estimates the affected packages reach up to 100 million weekly downloads.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | Reported payload/C2 host associated with the malware dropper and RAT. |
| IPV4 | 142[.]11[.]206[.]73 | Reported payload/C2 host associated with the malware dropper and RAT. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article reports an obfuscated dropper and cleanup of package artifacts to hinder inspection.T1059.006 · PythonThe package postinstall script ran node setup.js to download the dropper.T1071.001 · Web ProtocolsThe article reports retrieval of payloads and communication with remote hosts using web protocols.T1078 · Valid AccountsThe attacker reportedly used compromised Axios maintainer credentials to publish malicious releases.T1195.002 · Compromise Software Supply ChainThe attacker reportedly compromised the software dependency chain by publishing poisoned npm packages.
Products
AxiosAn attacker used compromised credentials of an Axios maintainer to publish poisoned npm packages that added a malicious dependency and executed a postinstall script to deploy a platform-specific Remote Access Trojan.Node.js[T1059.006 ] Command and Scripting Interpreter: Node.js – Executed a postinstall Node.js script that downloaded a dropper: ‘the postinstall script (node setup.js) that runs automatically on npm install downloaded annpmAn attacker used compromised credentials of an Axios maintainer to publish poisoned npm packages that added a malicious dependency and executed a postinstall script to deploy a platform-specific Remote Access Trojan.