Researchers Link Three Malicious npm Packages to the Axios Attacker
Summary
OpenSourceMalware reports three npm packages that steal developer credentials and use a command-and-control server distinct from the Axios attack’s infrastructure. Shared cryptographic artifacts are cited as evidence linking the campaigns.
Key points
- The packages redeem-onchain-sdk, nicegui, and period-newline reportedly use npm postinstall hooks to execute an infostealer.
- The malware collects system information and targets credentials and secrets including .env files, AWS credentials, SSH keys, npm settings, and Docker configuration.
- According to the analysis, the packages encrypt collected data and send it over TCP to 18.208.244.120:9999; they also query api[.]ipify[.]org for external IP discovery.
- The researchers cite the shared XOR key OrDeR_7077 and similarities in payloads and obfuscation as evidence connecting the packages to the March 2026 Axios compromise.
- The packages reportedly delete their payload file and modify package.json to hide evidence.
- The article advises removing the affected packages, auditing installations, rotating potentially exposed credentials, and checking for listed file and network indicators.
Article Details
- Attack Vectors
- The threat actor published malicious NPM packages whose postinstall hooks delivered and executed an infostealer.
- The original Axios compromise reportedly followed social engineering of the lead maintainer and use of a stolen long-lived NPM token to publish backdoored versions.
- The malware collected developer credentials and configuration files, gathered system information and Git activity, then exfiltrated encrypted data over TCP.
- Defensive Notes
- Remove redeem-onchain-sdk, nicegui, and period-newline if installed, and review package.json and package-lock.json for affected packages.
- Rotate potentially exposed AWS, SSH, NPM, Docker registry, and Git repository credentials.
- Check systems for the malicious index5_test.js payload and /tmp/.redeem_err.log, and review outbound connections to 18.208.244.120.
- Extend threat hunting beyond the original Axios indicators to include the secondary campaign's infrastructure and package indicators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | C2 domain reported for the original Axios compromise; the malware was downloaded from this host. |
| IPV4 | 142[.]11[.]206[.]73 | C2 infrastructure reported for the original Axios compromise, on port 8000. |
| IPV4 | 18[.]208[.]244[.]120 | Secondary campaign C2 server used for encrypted TCP exfiltration on port 9999. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe malware queried an external-IP service to identify the infected machine's external IP address.T1027 · Obfuscated Files or InformationThe payload used layered AES, XOR, and Base64 obfuscation to conceal strings and execution flow.T1036 · MasqueradingThe packages used misleading utility descriptions and innocent-looking class names to disguise malicious functionality.T1041 · Exfiltration Over C2 ChannelThe malware exfiltrated collected data to its C2 server over a custom TCP protocol.T1059.007 · JavaScriptThe packages used JavaScript entrypoint code and NPM postinstall hooks to execute the payload.T1070.004 · File DeletionThe payload deleted its entrypoint file and rewrote package.json to hide evidence.T1082 · System Information DiscoveryThe malware collected host information, including the hostname and username.T1195.001 · Compromise Software Dependencies and Development ToolsThe actor distributed malicious code through compromised or malicious NPM packages, including backdoored Axios versions and secondary packages.T1552.001 · Credentials In FilesThe malware harvested sensitive files including .env, AWS credentials, SSH keys, .npmrc, and .netrc.T1555.003 · Credentials from Web BrowsersOn Windows, the malware targeted Chrome's saved-password Login Data file.
People
Threat Actors
Sapphire SleetMicrosoft tracked the same activity attributed by Google Threat Intelligence Group to UNC1069 under this name.UNC1069Google Threat Intelligence Group attributed the original Axios campaign to UNC1069; the article links the secondary packages to that activity through shared cryptographic artifacts.
Products
Axiosmalicious packages that deliver a powerful infostealer. They appear to be connected to the high-profile Axios package compromise that shook the JavaScript ecosystem in March 2026. While the security community focusednpmOn March 31, 2026, attackers compromised the npm account of axios lead maintainer Jason Saayman via a social engineering campaign (fake company, branded Slack workspace, Teams call with a malicious "fix" prompt) and