Axios npm Supply-Chain Attack Deployed Cross-Platform RATs; Hunt.io Links It to TA444/BlueNoroff

Apr 1, 2026 · Original article ↗

Summary

Hunt.io details malicious Axios npm releases that installed cross-platform RATs through an obfuscated dropper, and attributes the campaign to TA444/BlueNoroff based on malware and infrastructure overlaps.

Key points

The article says attackers compromised Axios maintainer jasonsaayman’s npm account and published malicious axios@1.14.1 and axios@0.30.4 releases.
A staged plain-crypto-js@4.2.1 dependency used an obfuscated postinstall dropper to detect the operating system, deploy a platform-specific RAT, and remove installation traces.
The RATs for Windows, macOS, and Linux shared C2 commands for remote script execution, file browsing, binary deployment, and termination; Windows also established Registry Run-key persistence.
The reported C2 was sfrclak.com at 142.11.206.73 over HTTP port 8000. The article provides related file hashes, host artifacts, and network indicators.
Hunt.io attributes the campaign to TA444/BlueNoroff, citing shared infrastructure indicators and classifying the macOS RAT as NukeSped.
The article recommends treating systems that installed the malicious versions as compromised, checking for indicators, rotating accessible credentials and keys, and reviewing dependency-install practices.

Article Details

Attack Vectors: The attacker compromised maintainer jasonsaayman's npm account, changed its registered email, and manually published malicious axios@1.14.1 and axios@0.30.4 outside the legitimate CI/CD pipeline.
The attacker first published clean plain-crypto-js@4.2.0, then weaponized v4.2.1 approximately 18 hours later with a postinstall hook executing setup.js.
The obfuscated Node.js dropper detected the operating system and downloaded a platform-specific RAT: PowerShell on Windows, Python on Linux, or a compiled Mach-O binary on macOS.
Windows delivery renamed PowerShell to wt.exe and used hidden VBScript and cmd.exe execution. Windows persistence re-downloaded the RAT into memory through a Registry Run key.
The RATs accepted remote script execution and filesystem-browsing commands. Windows supported injection into cmd.exe, while macOS supported binary dropping and ad-hoc signing. The Linux binary-drop handler was broken by an undefined variable.
The dropper deleted itself and the malicious package manifest, then installed a clean v4.2.0 manifest stub to conceal the infection.
Defensive Notes: Treat systems that installed axios@1.14.1 or axios@0.30.4 as compromised and rotate accessible credentials, API keys, SSH keys, and tokens.
Inspect network logs for the reported C2 domain and IP on port 8000. Monitor outbound HTTP POST traffic using the fake IE8 User-Agent mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0).
Check for /Library/Caches/com.apple.act.mond, %PROGRAMDATA%\wt.exe, %PROGRAMDATA%\system.bat, and /tmp/ld.py.
Monitor Registry Run key changes using the value name MicrosoftUpdate. On affected Windows systems, remove that value and delete system.bat and wt.exe.
Detect codesign --force --deep --sign - launched by non-standard parent processes on macOS.
Flag processes launched by npm postinstall hooks that make outbound network connections.
Pin dependency versions in package-lock.json, use npm ci in CI/CD pipelines, and use --ignore-scripts when postinstall hooks are unnecessary.
Integrate dependency scanning into build workflows, monitor publications for missing OIDC Trusted Publisher signatures, and restrict outbound HTTP on non-standard ports.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`a0info[.]v6[.]army`	JustJoin landing-page domain listed as related TA444/BlueNoroff infrastructure.
DOMAIN	`sfrclak[.]com`	Defanged C2 domain listed in the network indicators.
EMAIL	`ifstap@proton[.]me`	Email address set by the attacker on the compromised npm maintainer account.
EMAIL	`nrwise@proton[.]me`	Attacker account address used to publish the staged plain-crypto-js package.
IPV4	`108[.]174[.]194[.]196`	Related infrastructure sharing the JustJoin server's SSH key; the article identifies it as phishing infrastructure based on open email ports.
IPV4	`108[.]174[.]194[.]44`	Related infrastructure sharing an SSH key fingerprint with the JustJoin server; reported active at the time of writing.
IPV4	`142[.]11[.]206[.]73`	Defanged C2 IP used for infrastructure pivoting and listed in the IOC section.
IPV4	`23[.]254[.]167[.]216`	Reported TA444/BlueNoroff JustJoin landing-page server sharing a unique HTTP ETag with the Axios C2.
SHA1	`07d889e2dadce6f3910dcbc253317d28ca61c766`	Package SHA listed for malicious plain-crypto-js@4.2.1; reproduced exactly despite its nonstandard length.
SHA1	`d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71`	Package SHA listed for malicious axios@0.30.4; reproduced exactly despite its nonstandard length.
SHA256	`506690fcbd10fbe6f2b85b49a1fffa9d984c376c25ef6b73f764f670e932cab4`	SHA-256 of the macOS Mach-O RAT.
SHA256	`617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101`	SHA-256 of the Windows PowerShell RAT.
SHA256	`e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09`	SHA-256 of the setup.js dropper.
SHA256	`e1f6b7f621a391a9d26e9a196974f3e2cc1ce8b4d8f73a14b2e8cb0f2a40289f`	SSH key fingerprint shared across three servers attributed by the article to coordinated DPRK infrastructure; not a malware file hash.
SHA256	`f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd`	SHA-256 of the Windows Stage-1 launcher.
SHA256	`fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf`	SHA-256 of the Linux Python RAT.
URL	`hxxp[:]//sfrclak[.]com:8000/`	C2 base URL recovered from the dropper's encrypted string table.
URL	`hxxp[:]//sfrclak[.]com:8000/6202033`	Payload download and RAT C2 endpoint shown in the Linux delivery command.