Malicious Axios npm Releases Deliver Cross-Platform RATs

Summary

Researchers report that attackers compromised an Axios maintainer’s npm account and published two releases with a malicious post-install dependency that deploys OS-specific RATs. Downstream impact is unknown; users are advised to pin clean versions and rotate exposed…

Key points

Researchers say attackers compromised Axios maintainer Jason Saayman’s npm account and published [email protected] and [email protected] without OIDC provenance or matching GitHub commits.
The releases added plain-crypto-js@^4.2.1, whose post-install script launched an obfuscated dropper that retrieved payloads based on the host operating system.
The reported Windows chain used VBScript and PowerShell for execution and persistence; macOS used AppleScript to run a binary, while Linux ran a Python payload.
The RAT could execute commands, retrieve and run an encoded binary, and enumerate directories. The installer deleted itself and restored package.json to hinder forensic analysis.
Researchers said the malicious dependency was staged about 18 hours in advance. The threat actor has not been identified, and the number of affected downstream projects is unknown.
Users are advised to pin to [email protected] or [email protected]; if compromise is confirmed, rotate credentials and rebuild from a known-good state.

Article Details

Attack Vectors: Attackers reportedly compromised Axios maintainer Jason Saayman’s npm account and published malicious Axios releases.
The releases added the plain-crypto-js@^4.2.1 dependency, whose post-install script launched an obfuscated dropper.
The dropper contacted a C2 server to retrieve an operating-system-specific payload for Windows, macOS, or Linux.
Defensive Notes: Pin Axios to the last known clean releases: [email protected] or [email protected].
If compromise is confirmed, rotate credentials and rebuild environments from a known-good state.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe post-install dropper was described as obfuscated.T1059.001 · PowerShellOn Windows, the attack used PowerShell to execute a downloaded script.T1059.002 · AppleScriptOn macOS, the malware used AppleScript to download and run a binary and to execute shell commands.T1059.003 · Windows Command ShellOn Windows, the attack launched a hidden Command Prompt window.T1059.004 · Unix ShellThe RAT could execute shell commands via /bin/sh.T1059.005 · Visual BasicOn Windows, the attack used VBScript as part of the execution chain.T1059.006 · PythonOn Linux, the dropper fetched and executed a Python-based payload.T1059.007 · JavaScriptThe malicious dependency's post-install script launched the JavaScript dropper setup.js.T1070.004 · File DeletionThe installer deleted itself and replaced the modified package.json with a clean copy to hinder forensic investigation.T1083 · File and Directory DiscoveryThe RAT could enumerate directories on infected hosts.T1105 · Ingress Tool TransferThe dropper contacted a C2 server to retrieve a next-stage payload selected for the detected operating system.T1195.002 · Compromise Software Supply ChainAttackers reportedly compromised the Axios npm account and published releases containing a malicious dependency.

People

Jason SaaymanThe article identifies him as the main Axios maintainer whose npm account was reportedly compromised to publish the malicious releases.

Products

AxiosHackers hijacked the npm account for the popular Axios package and published two malicious releases that included a dependency which installs remote access trojans on Linux, Windows, and macOS.npmHackers hijacked the npm account for the popular Axios package and published two malicious releases that included a dependency which installs remote access trojans on Linux, Windows, and macOS.plain-crypto-js#Axios #plain-crypto-js