Axios npm Supply Chain Attack: Cross-Platform RAT Delivery via Compromised Maintainer Credentials (GHSA-fw8c-xr5c-95f9) — Threadlinqs Intelligence
As of 2026-07-02, Axios npm Supply Chain Attack: Cross-Platform RAT Delivery via Compromised Maintainer Credentials (GHSA-fw8c-xr5c-95f9) is a critical-severity supply chain threat attributed to UNC1069 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0301 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: UNC1069 · North Korea · financial
Attackers compromised the npm account of primary Axios maintainer jasonsaayman via a stolen long-lived access token, publishing trojanized versions axios@1.14.1 and axios@0.30.4 with a malicious
The Axios npm supply chain attack represents one of the most significant open-source ecosystem compromises of 2026, targeting the axios HTTP client library — a foundational dependency present in approximately 80% of cloud and code environments with over 100 million weekly downloads from the npm registry.
ATTACK CHAIN OVERVIEW
The attack began on March 30, 2026 at 05:57 UTC when a reputation-seeding package, plain-crypto-js@4.2.0, was published to npm under the account "nrwise" (email: nrwise@proton.me). This clean version established download history and bypassed automated malware heuristics that flag newly published packages. Approximately 18 hours later, the weaponized version plain-crypto-js@4.2.1 was published, containing an obfuscated postinstall hook (setup.js) that serves as the initial dropper.
The threat actor had previously obtained a classic npm access token belonging to jasonsaayman, the primary Axios maintainer. This token lacked IP restrictions, expiration windows, or CIDR-scoped permissions — a common weakness in the npm ecosystem where a valid token serves as the sole authentication boundary. The attacker changed the registered email to ifstap@proton.me, locking the legitimate maintainer from account recovery.
On March 31, 2026 at approximately 01:30 UTC, the attacker used the compromised credentials to publish axios@1.14.1 and axios@0.30.4 with a single added dependency: "plain-crypto-js": "^4.2.1". This modification was minimal — a single line in package.json — designed to bypass code review by appearing logic-free.
DROPPER MECHANISM
Upon npm install, the postinstall hook in plain-crypto-js triggers setup.js, which performs OS detection and branches to platform-specific payload delivery. The dropper contacts the C2 server at sfrclak.com:8000 via the /6202033 campaign path. After payload delivery and execution, the dropper implements a sophisticated anti-forensics routine: it deletes setup.js, removes the malicious package.json, and replaces it with a clean version (package.md renamed to package.json), effectively erasing the infection chain evidence from disk.
PLATFORM-SPECIFIC PAYLOADS
macOS: The dropper uses AppleScript to fetch a compiled C++ Mach-O universal binary RAT, saved to /Library/Caches/com.apple.act.mond — a path and filename designed to masquerade as a legitimate Apple system daemon. The binary is executed via /bin/zsh, and the AppleScript is deleted post-execution. The RAT includes codesign capability for self-signing the injected payload. C2 beaconing occurs via HTTP POST to /product0 at 60-second intervals.
Windows: The dropper locates PowerShell, copies it to %PROGRAMDATA%\wt.exe (masquerading as Windows Terminal), creates a VBScript (%TEMP%\6202033.vbs) that retrieves the PowerShell-based RAT (stage2.ps1) from the C2 server. Persistence is achieved via a Registry Run key named "MicrosoftUpdate" at HKCU\Software\Microsoft\Windows\CurrentVersion\Run. C2 beaconing occurs via HTTP POST to /product1.
Linux: The dropper uses Node.js execSync to fetch a Python RAT script, saved to /tmp/ld.py and launched via nohup for persistence beyond terminal session closure. C2 beaconing occurs via HTTP POST to /product2.
RAT CAPABILITIES
All three platform RATs share common capabilities: remote shell command execution, filesystem enumeration and directory browsing, process enumeration and system reconnaissance, additional binary/payload injection, and self-termination on command from the C2 server. The 60-second beacon interval provides near-real-time command and control while remaining under many network monitoring thresholds.
IMPACT AND SCOPE
Given axios's ubiquity (100M+ weekly downloads, ~80% cloud environment prevalence), the blast radius of this compromise is substantial. Wiz research indicates approximately 3% of affected environments executed the malicious payload, suggesting tens of thousands of compromised systems. Any system that installed or ran the malicious versions should be consi
Target sectors: technology, financial, government, healthcare, education, telecommunications, retail, energy, manufacturing, media
Target regions: North America, Europe, Asia Pacific, South America, Middle East, Africa
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1195, T1585, T1608, T1059, T1059, T1059, T1059, T1059, T1204