Analysis Details Malicious npm Dependency Added to Axios Releases
Summary
An analysis describes how attackers allegedly used compromised axios maintainer accounts to publish versions with a malicious dependency. Its postinstall script delivered platform-specific RATs; npm removed the versions and revoked tokens.
Key points
- The article says attackers compromised the axios maintainer’s npm and GitHub accounts, then published axios@1.14.1 and axios@0.30.4 directly through the npm CLI without provenance attestations.
- The affected releases added plain-crypto-js, whose postinstall hook ran setup.js when installed.
- The setup script allegedly downloaded different RAT payloads for Windows, Linux, and macOS, with capabilities including remote code execution, system reconnaissance, and file enumeration.
- The reported malware used hxxp://sfrclak[.]com:8000/6202033 for command-and-control and included persistence and self-deletion techniques.
- The article reports npm administrators removed the compromised versions and revoked all tokens about three hours after the first malicious release.
- The analysis provides package, network, and file indicators, plus detection rules and response guidance, including isolating potentially affected systems and rotating credentials.
Article Details
- Attack Vectors
- The attacker reportedly compromised the axios maintainer's npm and GitHub accounts, then added the malicious transitive dependency plain-crypto-js to axios releases.
- Installing affected axios versions installed plain-crypto-js, whose npm postinstall hook automatically ran node setup.js.
- The setup script used obfuscated, platform-specific stages to download and execute RAT payloads for Windows, Linux, and macOS.
- Defensive Notes
- Check dependency trees and lockfiles for plain-crypto-js and affected axios versions 1.14.1 and 0.30.4; remove affected packages and isolate systems with suspected infection.
- Block the reported C2 domain and IP, and monitor for HTTP traffic on port 8000 and requests to /6202033.
- Look for the Windows Run key MicrosoftUpdate, system.bat and wt.exe, Linux /tmp/ld.py, and macOS /Library/Caches/com.apple.act.mond; remove persistence and terminate related processes.
- Rotate credentials on affected systems. The article recommends lockfile-based installs, auditing dependency lifecycle scripts, using vetted packages, and monitoring for suspicious network and process activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | Reported command-and-control domain contacted by the malware. |
ifstap@proton[.]me | Email address reported as replacing the compromised npm account's email during the incident. | |
nrwise@proton[.]me | Email address reported for the attacker-controlled npm account nrwise that staged plain-crypto-js. | |
| IPV4 | 142[.]11[.]206[.]73 | Reported IP address of the malware's C2 server. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | Reported HTTP C2 endpoint used by the malware for communication. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe setup script concealed strings using reversal, base64 decoding, character substitution, and XOR operations.T1055 · Process InjectionThe article describes the Windows payload as performing reflective DLL injection.T1057 · Process DiscoveryThe Linux RAT enumerated processes and collected their command lines and related process details.T1059.001 · PowerShellThe Windows payload used PowerShell for RAT activity and script execution.T1059.006 · PythonThe Linux RAT executed attacker-supplied Python code with python3.T1059.007 · JavaScriptThe package postinstall hook ran node setup.js, and the attack used JavaScript during installation.T1070.004 · File DeletionThe setup script deleted itself and package.json after launching the payload.T1071.001 · Web ProtocolsThe malware communicated with its C2 server over HTTP using POST requests.T1082 · System Information DiscoveryThe RAT collected system information including host, operating-system, hardware, and boot details.T1083 · File and Directory DiscoveryThe malware enumerated specified directories and reported file-system contents, including user folders.T1105 · Ingress Tool TransferThe setup script downloaded platform-specific stage-two RAT payloads from the C2 server.T1195.002 · Compromise Software Supply ChainThe attacker added the malicious plain-crypto-js dependency to axios releases, compromising software distributed through the npm supply chain.T1547.001 · Registry Run Keys / Startup FolderThe Windows payload established persistence through the HKCU Run key named MicrosoftUpdate.T1589.003 · Employee NamesThe attacker targeted the maintainer's npm and GitHub accounts for account takeover.T1620 · Reflective Code LoadingThe Windows payload reflectively loaded a .NET assembly from bytes in memory.