Axios npm Supply Chain Attack via Malicious plain-crypto-js Dependency (Cross-Platform RAT Dropper)
Axios npm Supply Chain Attack via Malicious plain-crypto-js (TL-2026-0300), also tracked as Axios npm RAT Attack, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-30. It is attributed to UNC1069 (North Korea) with high confidence, affects axios axios, maps to 13 MITRE ATT&CK techniques (T1027, T1036, T1059), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-0300
- Threat ID
- TL-2026-0300
- Also known as
- Axios npm RAT Attack, plain-crypto-js Supply Chain Compromise
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-30
- Last reviewed
- 2026-03-30
- Attribution
- UNC1069
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- financial
- Target sectors
- technology, financial, healthcare, government, education, retail, telecommunications, energy, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Axios npm Supply Chain Attack via Malicious plain-crypto-js
Malware and tooling: Custom HTTP RAT (sfrclak.com:8000)
Compromised Axios versions 1.14.1 and 0.30.4 were published to npm via a hijacked maintainer account, injecting a phantom dependency plain-crypto-js@4.2.1 that deploys a cross-platform remote access trojan (RAT) targeting macOS, Windows, and Linux. With 83 million weekly downloads, this represents one of the most impactful npm supply chain attacks ever documented.
How Axios npm Supply Chain Attack via Malicious plain-crypto-js works
On March 30-31, 2026, an attacker compromised the npm account of jasonsaayman, the lead maintainer of the Axios HTTP client library, and published two malicious versions — axios@1.14.1 and axios@0.30.4 — that introduced a phantom dependency on plain-crypto-js@4.2.1.
The attack was operationally sophisticated. The attacker first changed the compromised account's email to ifstap@proton.me, a ProtonMail address they controlled, then used a stolen npm access token to publish directly via the npm CLI — bypassing the project's established GitHub Actions CI/CD pipeline and OIDC Trusted Publisher mechanism. Neither malicious version has a corresponding GitHub tag or commit, a key anomaly that aided detection.
The malicious plain-crypto-js@4.2.1 package contained a postinstall hook (node setup.js) that served as a cross-platform RAT dropper. The setup.js file employed two-layer obfuscation: an XOR cipher using the key derived from 'OrDeR_7077' followed by Base64 encoding. When decoded, the script contacts the C2 server at http://sfrclak.com:8000/6202033 (IP: 142.11.206.73) and deploys platform-specific payloads.
On macOS, the dropper uses AppleScript to download and install a RAT binary to /Library/Caches/com.apple.act.mond, masquerading as an Apple system daemon. On Windows, it copies PowerShell to %PROGRAMDATA%\wt.exe (disguised as Windows Terminal), writes a VBScript dropper to %TEMP%\6202033.vbs and a PowerShell script to %TEMP%\6202033.ps1, then executes via cscript with hidden windows and bypass execution policy. On Linux, it downloads a Python script to /tmp/ld.py and executes it via python3.
Critically, the dropper performs evidence destruction after execution: it deletes setup.js, removes the original package.json containing the postinstall hook, and renames a pre-staged clean package.md to package.json. Post-infection, the only forensic indicator is the mere existence of the node_modules/plain-crypto-js/ directory with what appears to be a clean v4.2.0 manifest.
The attacker published a clean decoy version (plain-crypto-js@4.2.0) approximately 18 hours before the malicious version, establishing the package's presence on npm before weaponizing it. The plain-crypto-js package is never imported or required anywhere in the Axios source code — it exists solely as a vector for postinstall execution.
The C2 server differentiates payloads based on POST body identifiers: 'packages.npm.org/product0' for macOS, 'packages.npm.org/product1' for Windows, and 'packages.npm.org/product2' for Linux. The second-stage RAT payload provides the attacker with persistent remote access to compromised developer workstations and CI/CD build environments.
Socket Security's automated detection flagged the malicious plain-crypto-js@4.2.1 within minutes of publication. StepSecurity independently confirmed the compromise and published detailed technical analysis. The affected Axios versions have been deprecated on npm, and developers are urged to pin to axios@1.14.0 or axios@0.30.3.
MITRE ATT&CK techniques used in TL-2026-0300
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
execution
T1059 Command and Scripting Interpreter; T1204 User Execution
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
initial-access
credential-access
T1528 Steal Application Access Token
privilege-escalation
T1546 Event Triggered Execution
resource-development
Affected products and versions in Axios npm Supply Chain Attack via Malicious plain-crypto-js
- axios — axios
Vulnerable versions: 1.14.1; 0.30.4
Fixed in: 1.14.0; 0.30.3 - nrwise — plain-crypto-js
Vulnerable versions: 4.2.1
Remediation for Axios npm Supply Chain Attack via Malicious plain-crypto-js
Patches
- Downgrade to axios@1.14.0 (SHA1: 7c29f4cf2ea91ef05018d5aa5399bf23ed3120eb)
- Downgrade to axios@0.30.3 (SHA1: ab1be887a2d37dd9ebc219657704180faf2c4920)
Immediate actions
- Check all projects for axios@1.14.1 or axios@0.30.4 in package-lock.json or yarn.lock
- Remove node_modules/plain-crypto-js directory from all affected projects
- Block network traffic to sfrclak.com and 142.11.206.73 at perimeter firewalls
- Scan for file artifacts: /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\wt.exe (Windows), /tmp/ld.py (Linux)
- Run npm install --ignore-scripts to reinstall dependencies safely
- Pin axios to safe versions: 1.14.0 (1.x) or 0.30.3 (0.x)
Workarounds
- Add overrides/resolutions in package.json to force safe axios versions
- Use npm ci --ignore-scripts in all CI/CD pipelines
- Block plain-crypto-js at the registry level using npm organizational policies
Longer-term hardening
- Implement npm lockfile auditing in CI/CD pipelines to detect unexpected dependency additions
- Enable npm audit signatures verification to detect packages published outside trusted pipelines
- Deploy endpoint detection for postinstall hook abuse in node_modules
- Implement Software Bill of Materials (SBOM) tracking for all production dependencies
- Configure network monitoring for outbound connections from CI/CD and developer workstations to unknown domains
- Adopt dependency pinning with integrity hashes (npm ci with --ignore-scripts)
Weaknesses (CWE) in Axios npm Supply Chain Attack via Malicious plain-crypto-js
CWE-506, CWE-829, CWE-494, CWE-912
Timeline of Axios npm Supply Chain Attack via Malicious plain-crypto-js
- Malicious plain-crypto-js@4.2.1 published at 23:59:12 UTC with postinstall hook executing RAT dropper setup.js
- Attacker compromises jasonsaayman npm account, changes registered email to ifstap@proton.me (attacker-controlled ProtonMail)
- Attacker publishes clean decoy plain-crypto-js@4.2.0 to npm at 05:57 UTC — establishing package presence without malicious hooks
- Widespread community discussion on Hacker News; affected versions deprecated on npm; developers urged to pin safe versions
- StepSecurity publishes detailed technical analysis including full malware deobfuscation, C2 infrastructure, and platform-specific RAT behavior
- Socket Security publishes blog post detailing the axios supply chain compromise and affected versions
- Compromised axios@0.30.4 published to npm at 01:00 UTC — second malicious version targeting legacy 0.x branch users
- Compromised axios@1.14.1 published to npm at 00:21 UTC via stolen access token — bypassing OIDC Trusted Publisher mechanism
- Socket Security automated detection flags malicious plain-crypto-js@4.2.1 at 00:05:41 UTC — within 6 minutes of publication
- As of 2026-05-29, the specific incident is contained: malicious axios 1.14.1/0.30.4 were pulled from npm after ~3h live, fixed versions and a post-mortem shipped, and the sfrclak.com C2 is a flagged IOC. But attribution firmed to North Korea's Sapphire Sleet (UNC1069/BlueNoroff), whose ongoing supply-chain ops (Microsoft 4/16 macOS report) keep the actor a live concern.
Sources cited for Axios npm Supply Chain Attack via Malicious plain-crypto-js
- Socket Security: Supply Chain Attack on Axios Pulls Malicious Dependency from npm
- StepSecurity: axios Compromised on npm - Malicious Versions Drop Remote Access Trojan
- Hacker News Discussion: Active Supply Chain Attack on axios 1.14.1
- Snyk: axios 1.14.1 Vulnerability Details
- CyberSIXT Summary: axios Compromised on npm
- npm Package: axios
- GitHub: axios/axios Releases
Threats related to Axios npm Supply Chain Attack via Malicious plain-crypto-js
- Axios npm Supply Chain Attack: Cross-Platform RAT Delivery via Compromised Maintainer Credentials (GHSA-fw8c-xr5c-95f9)
- North Korea (UNC1069) Supply Chain Compromise of Axios NPM Package via Backdoored plain-crypto-js Dependency
- Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) — Cross-Platform RAT via Phantom Dependency
- Axios npm Supply Chain Compromise — WAVESHAPER.V2 Cross-Platform RAT Deployment by UNC1069/Sapphire Sleet (DPRK)
- Axios NPM Supply Chain Compromise — Cross-Platform RAT via Malicious Transitive Dependency (plain-crypto-js)
- Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) Reaches OpenAI macOS Signing Pipeline, Forces Apple Certificate Rotation — DPRK UNC1069 / Sapphire Sleet WAVESHAPER.V2
Detection coverage for TL-2026-0300
As of 2026-03-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0300 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.