Compromised Axios npm Releases Delivered Cross-Platform RAT

Mar 31, 2026 · Original article ↗

Summary

Trend Micro reports that a hijacked Axios maintainer account published two malicious npm releases that added a phantom dependency. Its postinstall hook deployed a cross-platform RAT and attempted to erase evidence; npm removed the compromised versions.

Key points

The attacker used a hijacked lead-maintainer npm account to publish [email protected] and [email protected] without the project's usual GitHub Actions OIDC Trusted Publisher binding.
Both releases added plain-crypto-js@^4.2.1, an unused dependency whose postinstall hook ran the malware during installation.
The dropper targeted macOS, Windows, and Linux, fetching platform-specific RAT payloads from attacker-controlled infrastructure.
The malware used obfuscation and masquerading, then deleted its setup script and malicious manifest and replaced the manifest with a clean-looking stub.
Trend Micro's monitored installation recorded outbound command-and-control connections and a detached Linux process.
The report identifies related packages using the same malware and advises checking for plain-crypto-js, rotating exposed credentials, blocking the command-and-control infrastructure, and rebuilding affected systems from a known-good state.

Article Details

Attack Vectors: The attacker hijacked the lead maintainer’s npm account and manually published poisoned Axios versions using a stolen npm access token.
The poisoned Axios releases added plain-crypto-js@^4.2.1, whose postinstall hook executed a cross-platform RAT dropper during dependency installation.
The dropper selected a platform-specific payload for macOS, Windows, or Linux, then communicated with C2 infrastructure to obtain or run the RAT.
Related packages used the same malware through a vendored dependency or by bundling a tampered Axios version.
Defensive Notes: Pin Axios to the stated safe versions: 1.14.0 or 0.30.3, and verify lockfiles.
Use npm ci --ignore-scripts in CI/CD and remove plain-crypto-js from affected installations.
Rotate npm tokens, cloud and SSH keys, CI/CD secrets, and other credentials exposed to affected workflows.
Rebuild affected systems from a known-good state if RAT artifacts are found; do not clean them in place.
Audit CI/CD workflows that installed affected versions, monitor for phantom dependencies and unexpected network egress, and block the reported C2 infrastructure.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`callnrwise[.]com`	Domain listed as a C2 server in the article’s IOC section.
DOMAIN	`sfrclak[.]com`	Attacker-operated C2 domain used by the RAT.
EMAIL	`ifstap@proton[.]me`	Attacker-controlled address used on the hijacked maintainer account.
IPV4	`142[.]11[.]206[.]73`	IP listed as the C2 server in the article’s IOC section.
SHA1	`07d889e2dadce6f3910dcbc253317d28ca61c766`	Hash of the malicious [email protected] package.
SHA1	`2553649f2322049666871cea80a5d0d6adc700ca`	Hash of the malicious [email protected] package.
SHA1	`d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71`	Hash of the malicious [email protected] package.
SHA256	`591a70e8b166265804c1e2add3f5554b38364a8750248a8c5be751c5cd9b1655`	Hash of 6202033.vbs, the PowerShell RAT downloader.
SHA256	`617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101`	Hash of a 6202033.ps1 PowerShell RAT sample.
SHA256	`92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a`	Hash of the malicious com.apple.act.mond artifact.
SHA256	`e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09`	Hash of setup.js, the RAT dropper.
SHA256	`ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c`	Hash of a 6202033.ps1 PowerShell RAT sample.
SHA256	`f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd`	Hash of system.bat, identified as a Windows fileless loader.
SHA256	`fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf`	Hash of ld.py, the Linux Python RAT.