# Axios npm Supply Chain Attack: Cross-Platform RAT Delivery via Compromised Maintainer Credentials (GHSA-fw8c-xr5c-95f9)

> Attackers compromised the npm account of primary Axios maintainer jasonsaayman via a stolen long-lived access token, publishing trojanized versions axios@1.14.1 and axios@0.30.4 with a malicious dependency (plain-crypto-js@4.2.1). The postinstall hook deploys platform-specific RATs — compiled C++ on macOS, PowerShell on Windows, and Python on Linux — that beacon to sfrclak.com:8000 every 60 seconds, providing remote shell, binary injection, and filesystem enumeration capabilities. With ~100 million weekly downloads and presence in ~80% of cloud environments, approximately 3% of affected environments executed the malicious payload before removal.

- **Published:** 2026-03-31T12:00:00Z
- **Last reviewed:** 2026-03-31T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0301
- **ID:** TL-2026-0301
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Axios npm supply chain attack represents one of the most significant open-source ecosystem compromises of 2026, targeting the axios HTTP client library — a foundational dependency present in approximately 80% of cloud and code environments with over 100 million weekly downloads from the npm registry.

ATTACK CHAIN OVERVIEW

The attack began on March 30, 2026 at 05:57 UTC when a reputation-seeding package, plain-crypto-js@4.2.0, was published to npm under the account "nrwise" (email: nrwise@proton.me). This clean version established download history and bypassed automated malware heuristics that flag newly published packages. Approximately 18 hours later, the weaponized version plain-crypto-js@4.2.1 was published, containing an obfuscated postinstall hook (setup.js) that serves as the initial dropper.

The threat actor had previously obtained a classic npm access token belonging to jasonsaayman, the primary Axios maintainer. This token lacked IP restrictions, expiration windows, or CIDR-scoped permissions — a common weakness in the npm ecosystem where a valid token serves as the sole authentication boundary. The attacker changed the registered email to ifstap@proton.me, locking the legitimate maintainer from account recovery.

On March 31, 2026 at approximately 01:30 UTC, the attacker used the compromised credentials to publish axios@1.14.1 and axios@0.30.4 with a single added dependency: "plain-crypto-js": "^4.2.1". This modification was minimal — a single line in package.json — designed to bypass code review by appearing logic-free.

DROPPER MECHANISM

Upon npm install, the postinstall hook in plain-crypto-js triggers setup.js, which performs OS detection and branches to platform-specific payload delivery. The dropper contacts the C2 server at sfrclak.com:8000 via the /6202033 campaign path. After payload delivery and execution, the dropper implements a sophisticated anti-forensics routine: it deletes setup.js, removes the malicious package.json, and replaces it with a clean version (package.md renamed to package.json), effectively erasing the infection chain evidence from disk.

PLATFORM-SPECIFIC PAYLOADS

macOS: The dropper uses AppleScript to fetch a compiled C++ Mach-O universal binary RAT, saved to /Library/Caches/com.apple.act.mond — a path and filename designed to masquerade as a legitimate Apple system daemon. The binary is executed via /bin/zsh, and the AppleScript is deleted post-execution. The RAT includes codesign capability for self-signing the injected payload. C2 beaconing occurs via HTTP POST to /product0 at 60-second intervals.

Windows: The dropper locates PowerShell, copies it to %PROGRAMDATA%\wt.exe (masquerading as Windows Terminal), creates a VBScript (%TEMP%\6202033.vbs) that retrieves the PowerShell-based RAT (stage2.ps1) from the C2 server. Persistence is achieved via a Registry Run key named "MicrosoftUpdate" at HKCU\Software\Microsoft\Windows\CurrentVersion\Run. C2 beaconing occurs via HTTP POST to /product1.

Linux: The dropper uses Node.js execSync to fetch a Python RAT script, saved to /tmp/ld.py and launched via nohup for persistence beyond terminal session closure. C2 beaconing occurs via HTTP POST to /product2.

RAT CAPABILITIES

All three platform RATs share common capabilities: remote shell command execution, filesystem enumeration and directory browsing, process enumeration and system reconnaissance, additional binary/payload injection, and self-termination on command from the C2 server. The 60-second beacon interval provides near-real-time command and control while remaining under many network monitoring thresholds.

IMPACT AND SCOPE

Given axios's ubiquity (100M+ weekly downloads, ~80% cloud environment prevalence), the blast radius of this compromise is substantial. Wiz research indicates approximately 3% of affected environments executed the malicious payload, suggesting tens of thousands of compromised systems. Any system that installed or ran the malicious versions should be considered fully compromised, requiring immediate credential rotation, artifact removal, and forensic investigation.

RELATED PACKAGES

The same threat actor infrastructure was linked to additional malicious npm packages: @shadanai/openclaw (versions 2026.3.28-2, 2026.3.28-3, 2026.3.31-1, 2026.3.31-2) and @qqbrowser/openclaw-qbot@0.0.130, suggesting a broader campaign beyond the axios compromise.

ROOT CAUSE

The npm registry treats a valid token as the sole authentication boundary. The compromised classic token bypassed all upstream security controls including GitHub Actions, branch protections, and code review requirements. This architectural weakness — where package registry credentials are decoupled from source code repository controls — remains a systemic risk across the npm ecosystem.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel

## Sources

- [Picus Security - Axios npm Supply Chain Attack: Cross-Platform RAT Delivery via Compromised Maintainer Credentials](https://www.picussecurity.com/resource/blog/axios-npm-supply-chain-attack-cross-platform-rat-delivery-via-compromised-maintainer-credentials)
- [Wiz - Axios NPM Distribution Compromised in Supply Chain Attack](https://www.wiz.io/blog/axios-npm-compromised-in-supply-chain-attack)
- [GitHub Security Advisory GHSA-fw8c-xr5c-95f9 - Malware in axios](https://github.com/advisories/GHSA-fw8c-xr5c-95f9)
- [npm Advisory MAL-2026-2306 - Malicious axios versions](https://www.npmjs.com/advisories/MAL-2026-2306)
- [npm - axios package](https://www.npmjs.com/package/axios)
- [axios GitHub Repository](https://github.com/axios/axios)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0301