Backdoored axios npm Releases Deliver Cross-Platform RAT, Huntress Reports
Summary
Huntress reports attackers compromised the axios npm maintainer account and published malicious releases that installed a cross-platform RAT. At least 135 monitored endpoints contacted C2 infrastructure; affected systems should be rebuilt and credentials rotated.
Key points
- Attackers used compromised maintainer credentials to publish axios 1.14.1 and 0.30.4 with a malicious plain-crypto-js dependency that ran a post-install payload.
- The approximately three-hour exposure affected macOS, Windows, and Linux; Huntress observed at least 135 endpoints contacting the attackers' C2.
- The RAT collected system and user information, beaconed every 60 seconds, and supported remote command execution and binary injection. Windows infections also established login persistence.
- The dropper used obfuscation and anti-forensics, including deleting its files and replacing the package manifest; on Windows it disguised PowerShell as wt.exe.
- Huntress and other researchers cited overlaps with DPRK-linked activity; Google Threat Intelligence Group attributed the attack to UNC1069, described as a suspected North Korean threat actor.
- The malicious packages were removed and the identified C2 infrastructure was offline at the time of the update; Huntress advised rebuilding affected systems and rotating credentials.
- The article recommends checking lockfiles and endpoint artifacts, pinning safe axios versions, using lockfiles and npm ci, and removing long-lived npm publishing tokens.
Article Details
- Attack Vectors
- An attacker used compromised npm maintainer credentials and a long-lived access token to publish backdoored axios releases directly through the npm CLI, bypassing the usual GitHub Actions OIDC publishing workflow.
- The backdoored axios releases introduced plain-crypto-js as a phantom dependency. Its post-install hook ran setup.js and delivered platform-specific RAT payloads to macOS, Windows, and Linux systems.
- The Windows RAT established persistence with a hidden system.bat file and a MicrosoftUpdate registry Run key; it also supported remote script execution and in-memory .NET assembly loading.
- The macOS payload was downloaded with curl as a Mach-O binary and saved under a name resembling an Apple system file. The Linux payload was downloaded and run as a Python script.
- Defensive Notes
- Audit lockfiles and environments for axios versions 1.14.1 or 0.30.4, any version of plain-crypto-js, and the listed platform-specific artifacts.
- Treat systems that installed the malicious packages or executed their payloads as compromised. Rebuild affected systems from known-good images rather than attempting in-place cleanup.
- Rotate credentials accessible from affected systems, including npm tokens, SSH keys, cloud credentials, API keys, OAuth tokens, and CI/CD secrets.
- Block the reported C2 domain and IP, and investigate network and DNS logs for connections to them on port 8000.
- Pin dependencies, commit lockfiles, use npm ci in CI/CD, consider disabling install scripts, and remove long-lived npm tokens even when OIDC Trusted Publishing is configured.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | callnrwise[.]com | Domain the article identifies as linked to the compromise and as sharing a theme with calltan[.]com. |
| DOMAIN | calltan[.]com | Domain linked by researchers at Volexity to a binary recently used by DPRK actors; the article notes it contacted systems with a similar script and registry-key pattern. |
| DOMAIN | sfrclak[.]com | Reported command-and-control domain used by the RAT. |
ifstap@proton[.]me | Email address the attacker set on the compromised axios maintainer npm account. | |
nrwise@proton[.]me | Email address on the attacker-created npm account used to publish plain-crypto-js. | |
| IPV4 | 142[.]11[.]206[.]73 | Reported C2 IP address used on port 8000. |
| SHA1 | 07d889e2dadce6f3910dcbc253317d28ca61c766 | SHA-1 hash listed for the malicious plain-crypto-js 4.2.1 package. |
| SHA1 | 2553649f2322049666871cea80a5d0d6adc700ca | SHA-1 hash listed for the malicious axios 1.14.1 package. |
| SHA1 | d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 | SHA-1 hash listed for the malicious axios 0.30.4 package. |
| SHA256 | 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | SHA-256 hash listed for the Windows Stage 2 PowerShell RAT. |
| SHA256 | 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | SHA-256 hash listed for the macOS Mach-O universal RAT binary. |
| SHA256 | f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd | SHA-256 hash listed for the Windows Stage 1 PowerShell download cradle. |
| SHA256 | fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | SHA-256 hash listed for the Linux Python RAT script. |
| URL | hxxp[:]//sfrclak[.]com:8000/6202033 | Reported C2 endpoint used to download payloads and communicate with the RAT. |
MITRE ATT&CK
T1027 · Obfuscated Files or Informationsetup.js used reversed Base64 strings and an XOR scheme to obscure module names, commands, paths, and the C2 URL.T1036.005 · Match Legitimate Resource Name or LocationThe attacker copied powershell.exe to wt.exe to make it resemble the legitimate Windows Terminal filename.T1041 · Exfiltration Over C2 ChannelThe RAT sent reconnaissance data to the C2 in its initial beacon and subsequent communications.T1059.001 · PowerShellThe Windows RAT used PowerShell for payload execution and supported remote script execution.T1059.002 · AppleScriptOn macOS, osascript ran an AppleScript that downloaded the RAT with curl.T1059.003 · Windows Command ShellThe Windows chain used cmd.exe to invoke curl and execute the downloaded script.T1059.004 · Unix ShellThe Linux delivery command used a shell to download and launch the Python RAT.T1059.006 · PythonThe Linux payload was a Python RAT executed with python3.T1059.007 · JavaScriptThe plain-crypto-js post-install hook ran the JavaScript setup.js dropper.T1070.004 · File DeletionThe dropper deleted itself and package.json, then replaced the manifest with a clean-looking stub; Windows launch scripts also self-deleted.T1071.001 · Web ProtocolsThe RAT used HTTP POST requests to communicate with its C2.T1083 · File and Directory DiscoveryThe RAT enumerated user directories and filesystem locations, including platform-specific directories.T1105 · Ingress Tool TransferThe dropper and RAT downloaded platform-specific payloads from the reported C2.T1195.002 · Compromise Software Supply ChainThe attacker published backdoored axios releases that introduced a malicious dependency and post-install payload.T1547.001 · Registry Run Keys / Startup FolderThe Windows RAT created a MicrosoftUpdate registry Run key pointing to a hidden system.bat file.
People
Chad HudsonHuntress SOC analyst who documented the wt.exe evasion and observed the attack chain.Jevon AngHuntress SOC analyst who flagged wt.exe appearing across multiple hosts and organizations.John HammondNamed author of the Huntress analysis.Jordan SextonHuntress SOC analyst who shared the Windows Stage 2 RAT source code captured while the C2 was serving payloads.Max RogersHuntress SOC analyst who shared the initial public alert in the SOC channel.Michael ElfordHuntress SOC analyst who traced the execution chain and identified the persistence mechanism.
Threat Actors
Products
AxiosHomeBlogSupply Chain Compromise of axios npm PackageGitHub Actionswas changed from the legitimate address to ifstap@proton[.]me, and the attacker bypassed the normal GitHub Actions OIDC-based CI/CD publishing workflow by publishing directly via the npm CLI using a long-lived accessNode.jsaxios is a promise-based HTTP client used extensively across the JavaScript and Node.js ecosystem.npmHomeBlogSupply Chain Compromise of axios npm Packageplain-crypto-jsOther researchers, including ones at Elastic, have noted that the macOS binary delivered by the plain-crypto-js post-install hook has overlaps with a backdoor attributed to a DPRK-linked threat cluster.