# Axios npm Supply Chain Attack via Malicious plain-crypto-js Dependency (Cross-Platform RAT Dropper)

> Compromised Axios versions 1.14.1 and 0.30.4 were published to npm via a hijacked maintainer account, injecting a phantom dependency plain-crypto-js@4.2.1 that deploys a cross-platform remote access trojan (RAT) targeting macOS, Windows, and Linux. With 83 million weekly downloads, this represents one of the most impactful npm supply chain attacks ever documented.

- **Published:** 2026-03-30T12:00:00Z
- **Last reviewed:** 2026-03-30T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0300
- **ID:** TL-2026-0300
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 30-31, 2026, an attacker compromised the npm account of jasonsaayman, the lead maintainer of the Axios HTTP client library, and published two malicious versions — axios@1.14.1 and axios@0.30.4 — that introduced a phantom dependency on plain-crypto-js@4.2.1.

The attack was operationally sophisticated. The attacker first changed the compromised account's email to ifstap@proton.me, a ProtonMail address they controlled, then used a stolen npm access token to publish directly via the npm CLI — bypassing the project's established GitHub Actions CI/CD pipeline and OIDC Trusted Publisher mechanism. Neither malicious version has a corresponding GitHub tag or commit, a key anomaly that aided detection.

The malicious plain-crypto-js@4.2.1 package contained a postinstall hook (node setup.js) that served as a cross-platform RAT dropper. The setup.js file employed two-layer obfuscation: an XOR cipher using the key derived from 'OrDeR_7077' followed by Base64 encoding. When decoded, the script contacts the C2 server at http://sfrclak.com:8000/6202033 (IP: 142.11.206.73) and deploys platform-specific payloads.

On macOS, the dropper uses AppleScript to download and install a RAT binary to /Library/Caches/com.apple.act.mond, masquerading as an Apple system daemon. On Windows, it copies PowerShell to %PROGRAMDATA%\wt.exe (disguised as Windows Terminal), writes a VBScript dropper to %TEMP%\6202033.vbs and a PowerShell script to %TEMP%\6202033.ps1, then executes via cscript with hidden windows and bypass execution policy. On Linux, it downloads a Python script to /tmp/ld.py and executes it via python3.

Critically, the dropper performs evidence destruction after execution: it deletes setup.js, removes the original package.json containing the postinstall hook, and renames a pre-staged clean package.md to package.json. Post-infection, the only forensic indicator is the mere existence of the node_modules/plain-crypto-js/ directory with what appears to be a clean v4.2.0 manifest.

The attacker published a clean decoy version (plain-crypto-js@4.2.0) approximately 18 hours before the malicious version, establishing the package's presence on npm before weaponizing it. The plain-crypto-js package is never imported or required anywhere in the Axios source code — it exists solely as a vector for postinstall execution.

The C2 server differentiates payloads based on POST body identifiers: 'packages.npm.org/product0' for macOS, 'packages.npm.org/product1' for Windows, and 'packages.npm.org/product2' for Linux. The second-stage RAT payload provides the attacker with persistent remote access to compromised developer workstations and CI/CD build environments.

Socket Security's automated detection flagged the malicious plain-crypto-js@4.2.1 within minutes of publication. StepSecurity independently confirmed the compromise and published detailed technical analysis. The affected Axios versions have been deprecated on npm, and developers are urged to pin to axios@1.14.0 or axios@0.30.3.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1140 Deobfuscate/Decode Files or Information
- T1528 Steal Application Access Token
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1586 Compromise Accounts
- T1608 Stage Capabilities

## Sources

- [Socket Security: Supply Chain Attack on Axios Pulls Malicious Dependency from npm](https://socket.dev/blog/axios-npm-package-compromised)
- [StepSecurity: axios Compromised on npm - Malicious Versions Drop Remote Access Trojan](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan)
- [Hacker News Discussion: Active Supply Chain Attack on axios 1.14.1](https://news.ycombinator.com/item?id=47581837)
- [Snyk: axios 1.14.1 Vulnerability Details](https://security.snyk.io/package/npm/axios/1.14.1)
- [CyberSIXT Summary: axios Compromised on npm](https://cybersixt.com/a/HuZ7Knn24Q3Gt4DNMzNHv3)
- [npm Package: axios](https://www.npmjs.com/package/axios)
- [GitHub: axios/axios Releases](https://github.com/axios/axios/releases)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0300