Compromised axios npm releases added a dependency that deployed a cross-platform RAT
Summary
A hijacked axios maintainer account published versions 1.14.1 and 0.30.4 that pulled in plain-crypto-js, whose install script deployed a cross-platform RAT. Datadog traced the chain, C2 behavior and payload bugs; npm removed the packages and revoked tokens.
Key points
- On March 31, 2026, an attacker used a compromised axios maintainer account to publish versions 1.14.1 and 0.30.4; 1.14.1 was tagged latest, exposing unpinned installs during the roughly three-hour window.
- The releases added [email protected], a typosquatted dependency whose postinstall script downloaded and executed platform-specific payloads from hxxp://sfrclak[.]com:8000/6202033.
- Registry metadata showed the malicious release was published from a direct account session rather than GitHub Actions OIDC; the maintainer email in the metadata also changed.
- The payloads used HTTP POST for C2, collected directory listings and system information, and supported commands including runscript and peinject.
- The investigated payloads had functional limitations: the Windows script set up persistence but did not start its RAT loop, while the Linux payload could crash in containerized or background environments.
- npm replaced the malicious dependency, removed the compromised axios versions and revoked package tokens; the article also provides queries and artifacts for scoping affected systems and hunting for follow-on activity.
Article Details
- Attack Vectors
- An attacker used a compromised axios maintainer account to publish [email protected] and [email protected] directly, bypassing the GitHub Actions OIDC trusted-publishing workflow.
- The malicious axios releases added the typosquatted dependency [email protected], whose postinstall script automatically downloaded and executed platform-specific RAT payloads.
- The payloads retrieved follow-on code from the reported C2 endpoint and used HTTP POST for beaconing and data transmission; the Windows variant also created login persistence through a registry Run key.
- Defensive Notes
- The article identifies [email protected], [email protected], and [email protected] as compromised packages; pin versions rather than allowing affected floating installs.
- npm removed the compromised releases and revoked package tokens. The maintainer also reported resetting passwords and security keys and revoking sessions; the article notes that v0.x had relied on a long-lived npm token.
- Use library inventory to identify affected installations, including the article's suggested query: library_name:axios status:Open library_version:(1.14.1 OR 0.30.4).
- Hunt for C2 traffic and dropped-file or process artifacts, including sfrclak[.]com, 142.11.206.73, and the reported macOS, Windows, and Linux payload paths.
- The article describes Supply-Chain Firewall as a tool that blocks known malicious packages.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | Reported C2 domain used to deliver payloads and receive RAT communications. |
ifstap@proton[.]me | Email shown as the publisher address for the compromised axios release and identified in the article as the attacker email. | |
nrwise@proton[.]me | StepSecurity reportedly identified this as the publisher email for the malicious plain-crypto-js package. | |
| IPV4 | 142[.]11[.]206[.]73 | Reported A record for the RAT's C2 domain. |
| SHA256 | 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | SHA-256 of the reported Windows PowerShell payload. |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | SHA-256 of the reported macOS Mach-O payload. |
| SHA256 | fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | SHA-256 of the reported Linux Python payload. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | Reported stage-two download and C2 beacon endpoint used by the payloads. |
MITRE ATT&CK
T1027 · Obfuscated Files or Informationsetup.js concealed strings and commands using reversed strings, base64 decoding, and XOR transformations.T1041 · Exfiltration Over C2 ChannelThe RAT sent directory listings and system information to its C2 in HTTP POST messages.T1057 · Process DiscoveryThe RAT's BaseInfo message included information about running processes.T1059.001 · PowerShellThe Windows payload executed a downloaded PowerShell script with execution-policy bypass and hidden-window options.T1059.002 · AppleScriptThe macOS setup wrote and executed an AppleScript dropper using osascript.T1059.006 · PythonThe Linux payload was a Python RAT launched with python3.T1059.007 · JavaScriptThe malicious dependency's npm postinstall script ran setup.js using Node.js.T1070.004 · File DeletionAfter execution, the installer deleted its setup script and replaced package.json with a copy lacking the postinstall hook.T1071.001 · Web ProtocolsThe RAT used HTTP POST requests to the C2 endpoint for communications.T1078 · Valid AccountsThe attacker used a compromised maintainer account to publish package releases and delete GitHub issue reports.T1082 · System Information DiscoveryThe RAT sent system details including hostname, OS, architecture, timezone, boot time, hardware model, and CPU.T1083 · File and Directory DiscoveryThe RAT collected directory listings and supported commands to enumerate directories.T1105 · Ingress Tool TransferThe postinstall script fetched platform-specific second-stage payloads from the reported C2 endpoint.T1195 · Supply Chain CompromiseThe attacker compromised a maintainer account and published malicious axios releases that introduced a trojanized dependency.T1547.001 · Registry Run Keys / Startup FolderThe Windows payload registered a MicrosoftUpdate Run key and wrote system.bat to re-fetch the payload at login.
People
Ashish KurmiStepSecurity contributor who reported the compromise in GitHub issues, two of which were deleted through the compromised account.DigitalBrainJSAxios maintainer who opened a deprecation-workflow pull request, contacted npm, and helped get compromised versions and tokens revoked.jasonsaaymanAxios maintainer whose account was compromised; they acknowledged the incident, reported revoking a long-lived npm token, and investigated the account takeover.
Products
AxiosOn March 31, 2026, an attacker hijacked an axios npm maintainer account and published malicious releases ([email protected] and 0.30.4) that added a typosquatted dependency plain-crypto-js which executed a cross-platform RATDatadog Code SecurityDatadog Code Security can identify hosts, containers, and build environments where the compromised version was installed.GitHub ActionsThe legitimate [email protected] was published via GitHub Actions OIDC trusted publishing.npmOn March 31, 2026, an attacker hijacked an axios npm maintainer account and published malicious releases ([email protected] and 0.30.4) that added a typosquatted dependency plain-crypto-js which executed a cross-platform RATplain-crypto-jsand published malicious releases ([email protected] and 0.30.4) that added a typosquatted dependency plain-crypto-js which executed a cross-platform RAT during npm install.