Axios npm Attack Used Phantom Dependency to Deploy Cross-Platform RAT
Summary
The article reports that attackers used a hijacked Axios npm maintainer account to publish versions 1.14.1 and 0.30.4 with a phantom dependency that deployed cross-platform RAT payloads; the releases were removed and remediation is advised.
Key points
- The article says versions 1.14.1 and 0.30.4 were manually published using compromised maintainer credentials, bypassing GitHub Actions and OIDC trusted publishing.
- A phantom dependency, plain-crypto-js@^4.2.1, ran a post-install script to deploy a RAT and was not referenced in the Axios source code.
- Reported payloads used AppleScript on macOS, VBScript and PowerShell on Windows, and a Python script on Linux.
- The malware reportedly contacted sfrclak[.]com; its traffic was designed to resemble npm registry activity.
- The dropper reportedly used XOR and base64 obfuscation, then erased traces by replacing package metadata; runtime analysis found a 36-second delay before cleanup.
- The malicious Axios releases were reportedly available for nearly three hours before removal; the dependency was placed on security hold and replaced with a placeholder.
- The article advises affected users to rotate credentials, review network logs, rebuild systems, and reinstall dependencies with scripts disabled.
Article Details
- Attack Vectors
- A compromised Axios maintainer npm account was used to manually publish malicious Axios versions 1.14.1 and 0.30.4.
- The releases added the phantom dependency plain-crypto-js@^4.2.1, whose post-install script ran node setup.js and deployed a RAT.
- The RAT downloaded operating-system-specific payloads for macOS, Windows, and Linux; reported execution methods included AppleScript, VBScript, PowerShell, and Python.
- The dropper used XOR encoding and base64 transformations, then deleted its package.json and replaced it with a clean decoy to conceal evidence of compromise.
- Defensive Notes
- Treat systems that installed Axios 1.14.1 or 0.30.4 as compromised; the article identifies 1.14.0 and 0.30.3 as safe versions.
- Rotate credentials, including API keys and tokens, and review network logs for suspicious outbound connections.
- Rebuild affected systems rather than attempting partial cleanup, and reinstall dependencies with scripts disabled.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | Command-and-control domain contacted by the RAT deployed through the malicious Axios dependency. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe dropper used XOR encoding and base64 transformations to obfuscate its logic.T1036 · MasqueradingThe macOS binary was disguised as a legitimate system process, and Windows persistence mechanisms were disguised as system binaries.T1059.001 · PowerShellThe Windows payload used PowerShell to download and execute the RAT.T1059.002 · AppleScriptThe macOS payload used AppleScript to download and execute a binary.T1059.005 · Visual BasicThe Windows payload used VBScript to download and execute the RAT.T1059.006 · PythonThe Linux payload downloaded and executed a Python script at /tmp/ld.py.T1059.007 · JavaScriptThe dependency's post-install script ran node setup.js to deploy the RAT.T1070.004 · File DeletionThe malicious package deleted its package.json after execution and replaced it with a clean decoy.T1078 · Valid AccountsThe attacker used stolen credentials for a compromised Axios maintainer account to publish the releases.T1105 · Ingress Tool TransferThe RAT downloaded platform-specific payloads from its C2 server.T1195.002 · Compromise Software Supply ChainThe attacker introduced a malicious dependency into Axios releases distributed through npm.
Products
AxiosThe Axios supply chain attack on March 31, 2026 hijacked an npm maintainer account to publish poisoned Axios releases that installed a cross-platform remote access trojan via a phantom dependency.GitHub ActionsThe malicious releases bypassed GitHub Actions/ OIDC trusted publishing, lacking trusted publisher metadata and Git commits.npmThe Axios supply chain attack on March 31, 2026 hijacked an npm maintainer account to publish poisoned Axios releases that installed a cross-platform remote access trojan via a phantom dependency.