Axios npm Supply Chain Attack: Cross-Platform RAT Delivery via Compromised Maintainer Credentials (GHSA-fw8c-xr5c-95f9)

Axios npm Supply Chain Attack (TL-2026-0301), also tracked as GHSA-fw8c-xr5c-95f9, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-31. It is attributed to UNC1069 (North Korea) with high confidence, affects axios axios, maps to 18 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-0301

Threat ID
TL-2026-0301
Also known as
GHSA-fw8c-xr5c-95f9, MAL-2026-2306
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-03-31
Last reviewed
2026-03-31
Attribution
UNC1069
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
financial
Target sectors
technology, financial, government, healthcare, education, telecommunications, retail, energy, manufacturing, media
Target regions
North America, Europe, Asia Pacific, South America, Middle East, Africa
Detection rules
9
Indicators of compromise
29

Malware and tooling in Axios npm Supply Chain Attack

Malware and tooling: Custom HTTP RAT

Attackers compromised the npm account of primary Axios maintainer jasonsaayman via a stolen long-lived access token, publishing trojanized versions axios@1.14.1 and axios@0.30.4 with a malicious dependency (plain-crypto-js@4.2.1). The postinstall hook deploys platform-specific RATs — compiled C++ on macOS, PowerShell on Windows, and Python on Linux — that beacon to sfrclak.com:8000 every 60 seconds, providing remote shell, binary injection, and filesystem enumeration capabilities. With ~100 million weekly downloads and presence in ~80% of cloud environments, approximately 3% of affected environments executed the malicious payload before removal.

How Axios npm Supply Chain Attack works

The Axios npm supply chain attack represents one of the most significant open-source ecosystem compromises of 2026, targeting the axios HTTP client library — a foundational dependency present in approximately 80% of cloud and code environments with over 100 million weekly downloads from the npm registry.

ATTACK CHAIN OVERVIEW

The attack began on March 30, 2026 at 05:57 UTC when a reputation-seeding package, plain-crypto-js@4.2.0, was published to npm under the account "nrwise" (email: nrwise@proton.me). This clean version established download history and bypassed automated malware heuristics that flag newly published packages. Approximately 18 hours later, the weaponized version plain-crypto-js@4.2.1 was published, containing an obfuscated postinstall hook (setup.js) that serves as the initial dropper.

The threat actor had previously obtained a classic npm access token belonging to jasonsaayman, the primary Axios maintainer. This token lacked IP restrictions, expiration windows, or CIDR-scoped permissions — a common weakness in the npm ecosystem where a valid token serves as the sole authentication boundary. The attacker changed the registered email to ifstap@proton.me, locking the legitimate maintainer from account recovery.

On March 31, 2026 at approximately 01:30 UTC, the attacker used the compromised credentials to publish axios@1.14.1 and axios@0.30.4 with a single added dependency: "plain-crypto-js": "^4.2.1". This modification was minimal — a single line in package.json — designed to bypass code review by appearing logic-free.

DROPPER MECHANISM

Upon npm install, the postinstall hook in plain-crypto-js triggers setup.js, which performs OS detection and branches to platform-specific payload delivery. The dropper contacts the C2 server at sfrclak.com:8000 via the /6202033 campaign path. After payload delivery and execution, the dropper implements a sophisticated anti-forensics routine: it deletes setup.js, removes the malicious package.json, and replaces it with a clean version (package.md renamed to package.json), effectively erasing the infection chain evidence from disk.

PLATFORM-SPECIFIC PAYLOADS

macOS: The dropper uses AppleScript to fetch a compiled C++ Mach-O universal binary RAT, saved to /Library/Caches/com.apple.act.mond — a path and filename designed to masquerade as a legitimate Apple system daemon. The binary is executed via /bin/zsh, and the AppleScript is deleted post-execution. The RAT includes codesign capability for self-signing the injected payload. C2 beaconing occurs via HTTP POST to /product0 at 60-second intervals.

Windows: The dropper locates PowerShell, copies it to %PROGRAMDATA%\wt.exe (masquerading as Windows Terminal), creates a VBScript (%TEMP%\6202033.vbs) that retrieves the PowerShell-based RAT (stage2.ps1) from the C2 server. Persistence is achieved via a Registry Run key named "MicrosoftUpdate" at HKCU\Software\Microsoft\Windows\CurrentVersion\Run. C2 beaconing occurs via HTTP POST to /product1.

Linux: The dropper uses Node.js execSync to fetch a Python RAT script, saved to /tmp/ld.py and launched via nohup for persistence beyond terminal session closure. C2 beaconing occurs via HTTP POST to /product2.

RAT CAPABILITIES

All three platform RATs share common capabilities: remote shell command execution, filesystem enumeration and directory browsing, process enumeration and system reconnaissance, additional binary/payload injection, and self-termination on command from the C2 server. The 60-second beacon interval provides near-real-time command and control while remaining under many network monitoring thresholds.

IMPACT AND SCOPE

Given axios's ubiquity (100M+ weekly downloads, ~80% cloud environment prevalence), the blast radius of this compromise is substantial. Wiz research indicates approximately 3% of affected environments executed the malicious payload, suggesting tens of thousands of compromised systems. Any system that installed or ran the malicious versions should be considered fully compromised, requiring immediate credential rotation, artifact removal, and forensic investigation.

RELATED PACKAGES

The same threat actor infrastructure was linked to additional malicious npm packages: @shadanai/openclaw (versions 2026.3.28-2, 2026.3.28-3, 2026.3.31-1, 2026.3.31-2) and @qqbrowser/openclaw-qbot@0.0.130, suggesting a broader campaign beyond the axios compromise.

ROOT CAUSE

The npm registry treats a valid token as the sole authentication boundary. The compromised classic token bypassed all upstream security controls including GitHub Actions, branch protections, and code review requirements. This architectural weakness — where package registry credentials are decoupled from source code repository controls — remains a systemic risk across the npm ecosystem.

MITRE ATT&CK techniques used in TL-2026-0301

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information

exfiltration

T1041 Exfiltration Over C2 Channel

discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

execution

T1059 Command and Scripting Interpreter; T1204 User Execution

command-and-control

T1071 Application Layer Protocol; T1571 Non-Standard Port

initial-access

T1195 Supply Chain Compromise

credential-access

T1528 Steal Application Access Token

privilege-escalation

T1546 Event Triggered Execution

persistence

T1547 Boot or Logon Autostart Execution

resource-development

T1585 Establish Accounts; T1608 Stage Capabilities

Affected products and versions in Axios npm Supply Chain Attack

  • axios — axios
    Vulnerable versions: 1.14.1; 0.30.4
    Fixed in: 1.14.0; 0.30.3
  • nrwise — plain-crypto-js
    Vulnerable versions: 4.2.1
  • shadanai — @shadanai/openclaw
    Vulnerable versions: 2026.3.28-2; 2026.3.28-3; 2026.3.31-1; 2026.3.31-2
  • qqbrowser — @qqbrowser/openclaw-qbot
    Vulnerable versions: 0.0.130

Remediation for Axios npm Supply Chain Attack

Patches

  • Downgrade to axios@1.14.0 (safe) or axios@0.30.3 (safe)
  • Remove plain-crypto-js entirely from all dependency trees

Immediate actions

  • Audit all package lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for axios@1.14.1, axios@0.30.4, or plain-crypto-js@4.2.1
  • Block sfrclak.com and 142.11.206.73 at DNS and network perimeter
  • Search all endpoints for RAT artifacts: /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\wt.exe and %TEMP%\6202033.* (Windows), /tmp/ld.py (Linux)
  • Check Windows registry for HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate persistence key
  • Immediately rotate ALL secrets, API keys, tokens, and credentials on any system where malicious versions were installed
  • Monitor outbound connections to sfrclak.com:8000 and 142.11.206.73:8000 for active beaconing

Workarounds

  • Run npm install with --ignore-scripts to prevent postinstall hook execution (may break legitimate packages)
  • Use npm config set ignore-scripts true globally during incident response triage
  • Audit CI/CD pipeline run logs during the compromise window (March 31, 2026 01:30-08:00 UTC) for unauthorized access

Longer-term hardening

  • Migrate to granular npm tokens with IP allowlisting, expiration, and publish provenance (npm --provenance)
  • Implement Software Composition Analysis (SCA) in CI/CD pipelines to detect malicious dependencies
  • Deploy endpoint detection and response (EDR) with behavioral rules for postinstall hook abuse
  • Enforce npm audit and lockfile integrity checks in all build pipelines
  • Implement package pinning and hash verification for critical dependencies
  • Adopt npm package provenance verification via Sigstore

Weaknesses (CWE) in Axios npm Supply Chain Attack

CWE-506

Timeline of Axios npm Supply Chain Attack

  • Weaponized plain-crypto-js@4.2.1 published approximately 18 hours after the clean seed version, containing obfuscated postinstall dropper (setup.js)
  • Attacker publishes clean plain-crypto-js@4.2.0 to npm under account nrwise (nrwise@proton.me) to establish package reputation and bypass automated malware heuristics
  • Wiz and Picus Security publish detailed technical analyses documenting the full attack chain, IOCs, and remediation guidance for the ~80% of cloud environments using axios
  • GitHub Security Advisory GHSA-fw8c-xr5c-95f9 published classifying affected versions as malware with CWE-506; npm advisory MAL-2026-2306 also issued
  • Malicious axios versions removed from npm registry at approximately 08:00 UTC, ending a roughly 6.5-hour exposure window
  • Security researchers and automated detection systems flag anomalous behavior in axios postinstall hooks, identifying the supply chain compromise
  • C2 infrastructure at sfrclak.com:8000 begins receiving beacons from infected hosts across macOS, Windows, and Linux platforms via /product0, /product1, and /product2 endpoints
  • Malicious axios@1.14.1 and axios@0.30.4 published to npm at approximately 01:30 UTC with added dependency on plain-crypto-js@^4.2.1
  • Attacker uses stolen classic npm access token for jasonsaayman (primary Axios maintainer), changes registered email to ifstap@proton.me, locking legitimate maintainer from account recovery
  • As of 2026-05-29, this specific compromise is contained: malicious axios@1.14.1/0.30.4 and plain-crypto-js were pulled from npm within ~3 hours, the maintainer account was recovered with OIDC publishing adopted, and GHSA-fw8c-xr5c-95f9/CISA advisories issued. The perpetrator, now attributed to DPRK actor Sapphire Sleet/UNC1069, remains active in supply-chain attacks, so the tooling and operator could resurge.

Sources cited for Axios npm Supply Chain Attack

Threats related to Axios npm Supply Chain Attack

Detection coverage for TL-2026-0301

As of 2026-03-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0301 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats