Malicious Axios npm Releases Delivered Cross-Platform RATs in Supply-Chain Attack
Summary
A compromised axios maintainer account published two malicious npm versions that installed a dropper and platform-specific RATs. The releases were removed within hours; teams are urged to check for execution and rotate exposed credentials.
Key points
- On March 31, 2026, an attacker published axios versions 1.14.1 and 0.30.4 through a compromised maintainer account; both added the trojanized plain-crypto-js dependency.
- The dropper downloaded second-stage payloads from sfrclak[.]com:8000, then deleted itself and restored a clean package.json.
- The macOS, Windows, and Linux payloads supported remote shell execution, binary injection, directory browsing, process listing, and system reconnaissance.
- Windows malware established persistence using a registry Run key and a re-download batch file; the RATs beaconed to their C2 every 60 seconds.
- The malicious releases were removed within hours, but execution was observed in 3% of affected environments.
- Audit environments for downloads or execution of the affected versions; remove artifacts, investigate build systems and developer machines, and rotate credentials if execution is suspected.
- Monitor for connections to sfrclak[.]com:8000, beaconing, anomalous HTTP POST requests, and unexpected processes related to package installation.
Article Details
- Attack Vectors
- A compromised axios maintainer npm account was used to publish malicious axios versions 1.14.1 and 0.30.4, which added the trojanized plain-crypto-js dependency.
- During installation, setup.js downloads and executes operating-system-specific second-stage payloads from sfrclak.com:8000.
- The payloads beacon to a C2 server every 60 seconds, transmit system inventory, and await commands; reported capabilities include remote shell execution, binary injection, directory browsing, process listing, and system reconnaissance.
- The Windows payload establishes persistence using a registry Run key and a re-download batch file.
- Defensive Notes
- Audit environments for downloads or execution of axios versions 1.14.1 and 0.30.4, and remove malicious artifacts from endpoints, build systems, and production workloads.
- If execution is suspected, scan affected systems for exposed secrets and rotate credentials, API keys, and tokens.
- Review build pipelines and developer machines for unauthorized access or persistence.
- Monitor for outbound connections to sfrclak.com:8000, beaconing, anomalous HTTP POST requests, and unexpected process execution related to package installation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | callnrwise[.]com | Domain identified as a C2 pivot. |
| DOMAIN | sfrclak[.]com | C2 domain serving second-stage payloads. |
ifstap@proton[.]me | Email identified in the IOC appendix as a threat-actor email. | |
nrwise@proton[.]me | Email identified in the IOC appendix as a threat-actor email. | |
| IPV4 | 142[.]11[.]206[.]73 | C2 IP address. |
| SHA1 | 07d889e2dadce6f3910dcbc253317d28ca61c766 | Hash of the trojanized [email protected] package. |
| SHA1 | d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 | Hash of the malicious [email protected] package. |
| SHA256 | 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | Hash of the Windows second-stage PowerShell payload stage2.ps1. |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | Hash of the macOS second-stage Mach-O payload com.apple.act.mond. |
| SHA256 | e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 | Hash of the malicious setup.js dropper. |
| SHA256 | e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff | Hash of a system.bat Windows persistence-script variant. |
| SHA256 | ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c | Hash of the malicious PowerShell script 6202033.ps1. |
| SHA256 | f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd | Hash of the Windows persistence script system.bat. |
| SHA256 | fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | Hash of the Linux second-stage Python payload ld.py. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | C2 URL associated with the second-stage payload infrastructure. |
MITRE ATT&CK
T1057 · Process DiscoveryThe payloads can list running processes.T1059.001 · PowerShellThe Windows second-stage payload is a PowerShell script.T1059.006 · PythonThe Linux second-stage payload is delivered as a Python script.T1071.001 · Web ProtocolsThe payloads beacon to the C2 server every 60 seconds and use HTTP POST requests, according to the article's detection guidance.T1082 · System Information DiscoveryThe payloads perform system reconnaissance and transmit system inventory to the C2 server.T1083 · File and Directory DiscoveryThe payloads support directory browsing.T1105 · Ingress Tool TransferThe setup.js dropper downloads operating-system-specific second-stage payloads from the C2 infrastructure.T1195.002 · Compromise Software Supply ChainA compromised maintainer account was used to publish malicious versions of axios with a trojanized dependency.T1547.001 · Registry Run Keys / Startup FolderThe Windows payload establishes persistence through a registry Run key named MicrosoftUpdate.