Report: Axios npm Releases Poisoned After Maintainer Account Hijack
Summary
The article reports that an unknown actor hijacked an Axios maintainer’s npm account and published two releases with a malicious dependency. Its obfuscated postinstall script allegedly drops cross-platform RAT payloads and may expose developer and CI/CD secrets.
Key points
- The article reports that an unknown actor hijacked lead maintainer jasonsaayman’s npm account and manually published two poisoned Axios releases.
- The releases allegedly added a fake dependency with an obfuscated postinstall script that acts as a cross-platform RAT dropper.
- The script reportedly downloads platform-specific payloads from sfrclak[.]com and targets macOS, Windows, and Linux.
- The malware allegedly overwrites its package.json and deletes artifacts to hinder forensic analysis.
- Potentially exposed assets include developer credentials, SSH keys, cloud tokens, CI/CD secrets, and .env file contents; the article does not establish that these were accessed.
Article Details
- Victim Organization
- Axios
- Incident Type
- Software supply-chain attack involving hijacking a maintainer's npm account and publishing two malicious Axios releases with a fake dependency and an obfuscated postinstall script.
- Data Types Exposed
- Maintainer npm account credentials
- Developer workstation credentials
- SSH private keys
- Cloud environment access tokens
- CI/CD pipeline secrets
- .env file contents
- Operational Impact
- Two poisoned Axios releases were manually published, bypassing the project's standard GitHub Actions CI/CD pipeline. Their postinstall script reportedly targets macOS, Windows, and Linux systems, downloads platform-specific payloads, and deletes artifacts to hinder forensic detection. Developer and CI/CD assets may have been exposed; the article does not quantify affected systems or confirm specific data theft.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | Identified as the external command-and-control server from which the malicious postinstall script downloads stage-2 payloads. |
MITRE ATT&CK
T1070.004 · File DeletionThe malicious script reportedly deletes artifacts to evade post-incident forensic detection.T1105 · Ingress Tool TransferThe postinstall script reportedly downloads platform-specific stage-2 payloads from an external server.T1195.002 · Compromise Software Supply ChainThe attacker reportedly hijacked a maintainer's npm account and published malicious releases containing a fake dependency, compromising the software supply chain.