Malicious axios npm Releases Used a Hidden Dependency to Deploy Cross-Platform RATs

Mar 30, 2026 · Original article ↗

Summary

StepSecurity analyzed malicious axios versions 1.14.1 and 0.30.4, which added plain-crypto-js to launch a cross-platform RAT dropper. Runtime testing captured C2 contact and manifest replacement; npm removed the releases.

Key points

[email protected] and [email protected] added [email protected] as a runtime dependency without importing it in axios source code; its postinstall hook executed setup.js.
Registry metadata showed publishing under the compromised jasonsaayman account, without the Trusted Publisher binding used by legitimate releases. StepSecurity attributes this to stolen npm credentials.
Static analysis decoded a dropper targeting macOS through AppleScript, Windows through VBScript and PowerShell, and Linux through Python, contacting hxxp://sfrclak[.]com:8000/6202033.
The dropper deletes setup.js and replaces its manifest with a clean stub reporting version 4.2.0, potentially obscuring the installed malicious version during subsequent inspection.
StepSecurity's instrumented Linux test captured outbound C2 connections, a detached background process and replacement of the package manifest, supporting the reconstructed execution chain.
npm removed both malicious axios releases and replaced plain-crypto-js with a security-holder package. The Backstage team said the observed installation occurred in an intentionally sandboxed workflow and did not impact its project.
The article recommends checking dependency records and endpoint artifacts, rotating exposed credentials, rebuilding affected persistent machines and using installation-script restrictions and release-age policies.

Article Details

Attack Vectors: A compromised axios maintainer account was used to manually publish [email protected] and [email protected] using stolen npm credentials, bypassing the project's normal GitHub Actions publishing workflow.
Both poisoned releases added [email protected] as an unused runtime dependency. Its postinstall hook executed an obfuscated JavaScript dropper automatically during installation.
The dropper selected operating-system-specific commands to download and execute second-stage payloads on macOS, Windows, and Linux.
The malicious dependency cloned legitimate crypto-js source and metadata, while cleanup replaced its manifest with a clean stub reporting version 4.2.0.
Defensive Notes: Review dependency manifests, lockfiles, installation logs, and network telemetry for the compromised releases. Confirm search matches are actual dependency entries rather than documentation or comments.
Do not rely solely on the installed plain-crypto-js version: the dropper replaces its manifest with one reporting 4.2.0. Investigate the package directory and platform-specific payload artifacts.
The article recommends replacing compromised releases with [email protected] or [email protected], removing the malicious dependency, and using dependency overrides to prevent its reintroduction.
Treat affected developer machines and persistent CI runners as compromised: isolate them, inventory credentials, rebuild from a known-good state, and rotate credentials from a clean machine.
For affected ephemeral CI jobs, rotate all secrets available during execution even though the runner is subsequently destroyed.
Disable installation scripts in automated builds where feasible, enforce network egress allowlists, and apply package release-age or cooldown policies.
Use process, network, and file-integrity telemetry to detect callbacks, detached payload execution, and manifest replacement despite the dropper's self-deletion.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`sfrclak[.]com`	Attacker-controlled C2 domain contacted by the dropper and second-stage payload.
EMAIL	`ifstap@proton[.]me`	Attacker-controlled email assigned to the compromised axios maintainer account.
EMAIL	`nrwise@proton[.]me`	Account email used to publish the staged plain-crypto-js dependency and its malicious 4.2.1 release.
IPV4	`142[.]11[.]206[.]73`	C2 IP identified by the article; affected systems should be checked for connections on port 8000.
SHA1	`07d889e2dadce6f3910dcbc253317d28ca61c766`	Published package shasum for malicious [email protected].
SHA1	`2553649f2322049666871cea80a5d0d6adc700ca`	Published package shasum for malicious [email protected].
SHA1	`d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71`	Published package shasum for malicious [email protected].
SHA256	`e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09`	SHA-256 identified in the article for the malicious setup.js dropper.
URL	`hxxp[:]//sfrclak[.]com:8000/6202033`	C2 endpoint used to retrieve platform-specific payloads and receive subsequent callbacks.