Compromised Axios npm Releases Deliver Cross-Platform RAT
Summary
StepSecurity reported that two compromised Axios npm releases installed a malicious dependency whose postinstall script deployed a RAT on macOS, Windows, and Linux. The article recommends downgrading, checking for compromise, and rotating credentials.
Key points
- The attacker reportedly used a compromised Axios maintainer account to publish two malicious npm releases, bypassing the usual CI/CD pipeline.
- The releases added a malicious dependency that ran a postinstall script to deploy a cross-platform remote access trojan.
- The RAT contacted sfrclak[.]com on port 8000 to deliver platform-specific payloads; the dropper used obfuscation and self-cleanup.
- Affected environments include developer machines and CI/CD pipelines that installed the compromised releases.
- The article recommends downgrading to safe Axios versions, removing the malicious dependency, reinstalling with scripts disabled, and checking systems for RAT artifacts.
- It also advises blocking command-and-control traffic and rotating credentials on systems where the package ran.
Article Details
- Attack Vectors
- An attacker used compromised npm credentials for a lead axios maintainer to publish malicious axios versions outside the usual CI/CD pipeline.
- The compromised axios versions included the malicious plain-crypto-js dependency, whose postinstall script deployed a cross-platform RAT.
- The dropper contacted a command-and-control server to obtain platform-specific payloads.
- Defensive Notes
- Downgrade to the article's identified safe axios versions, remove plain-crypto-js, and reinstall dependencies with npm install --ignore-scripts.
- Check affected systems for RAT artifacts and treat systems where artifacts are found as fully compromised.
- Use --ignore-scripts in CI/CD pipelines, block the reported C2 traffic at the network or DNS layer, and rotate credentials on systems where the malicious package ran.
- The article recommends Harden-Runner network egress allowlists and StepSecurity Dev Machine Guard for visibility into packages installed on developer devices.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | C2 domain contacted by the dropper to deliver platform-specific payloads. |
| IPV4 | 142[.]11[.]206[.]73 | C2 IP reported for the dropper's payload-delivery connection. |
| SHA1 | 07d889e2dadce6f3910dcbc253317d28ca61c766 | Package shasum listed for the malicious plain-crypto-js dependency. |
| SHA1 | d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 | Package shasum listed for the malicious axios version 1.8.2. |
MITRE ATT&CK
T1059.007 · JavaScriptA package postinstall script executed to deploy the RAT.T1071.001 · Web ProtocolsThe dropper communicated with its C2 server; the article also specifies platform-specific C2 POST bodies.T1105 · Ingress Tool TransferThe dropper contacted the C2 server to deliver platform-specific payloads to affected systems.T1195.002 · Compromise Software Supply ChainThe attacker injected a malicious dependency into compromised axios package versions distributed through npm.
Products
Axiosidentified a sophisticated supply chain attack involving the compromise of two versions of the popular axios HTTP client library on npm: [email protected] and [email protected]. These versions were published usingnpmsupply chain attack involving the compromise of two versions of the popular axios HTTP client library on npm: [email protected] and [email protected]. These versions were published using compromised npm credentials
Tools
harden-runnerFor StepSecurity Enterprise Customers: - Utilize Harden-Runner to enforce network egress allowlists and detect anomalous network traffic. - Deploy StepSecurity Dev Machine Guard for real-time visibility into npmStepSecurity Dev Machine Guardto enforce network egress allowlists and detect anomalous network traffic. - Deploy StepSecurity Dev Machine Guard for real-time visibility into npm packages installed on developer devices.