Axios NPM Supply Chain Compromise — Cross-Platform RAT via Malicious Transitive Dependency (plain-crypto-js)
Axios NPM Supply Chain Compromise (TL-2026-0303), also tracked as Axios Supply Chain Compromise 2026, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-31. It is attributed to UNC1069 (North Korea) with high confidence, affects axios axios, maps to 15 MITRE ATT&CK techniques (T1005, T1036, T1057), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0303
- Threat ID
- TL-2026-0303
- Also known as
- Axios Supply Chain Compromise 2026
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-03-31
- Last reviewed
- 2026-03-31
- Attribution
- UNC1069
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- financial
- Target sectors
- technology, software-development, financial, healthcare, government, education, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Axios NPM Supply Chain Compromise
Malware and tooling: Custom HTTP RAT
A supply chain attack compromised axios npm package versions 1.14.1 and 0.30.4 through a malicious transitive dependency (plain-crypto-js@4.2.1). The attack deploys cross-platform RATs targeting Linux, Windows, and macOS via npm postinstall script execution, with C2 infrastructure at sfrclak.com (142.11.206.73). Axios is one of npm's most downloaded packages with approximately 60 million weekly downloads, making this a high-impact supply chain event.
How Axios NPM Supply Chain Compromise works
On March 31, 2026, Elastic Security Labs identified and reported a supply chain compromise affecting the widely-used axios npm package. The attack introduced malicious code through a transitive dependency injection strategy, where compromised axios versions 1.14.1 and 0.30.4 added a dependency on a malicious package named plain-crypto-js@4.2.1.
The attack chain begins during npm's postinstall phase, when plain-crypto-js's setup.js script executes automatically. This script acts as a platform-aware dropper, spawning OS-native interpreters to retrieve and execute second-stage payloads from the C2 server at sfrclak.com over HTTP port 8000.
On Linux, the dropper uses /bin/sh to invoke curl, downloading a Python-based RAT to /tmp/ld.py. The RAT runs detached via nohup, polls the C2 every 60 seconds, and supports runscript (shell/Python execution) and peinject (payload execution) commands. It reports hostname, username, OS, and process list during initial check-in.
On Windows, the attack renames PowerShell to C:\ProgramData\wt.exe to evade detection, then downloads 6202033.ps1 — a PowerShell-based RAT. Persistence is achieved via a registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate) that executes C:\ProgramData\system.bat on login. The RAT uses in-memory .NET assembly injection via Assembly.Load(byte[]) and supports peinject (.NET injection), runscript (PowerShell), and rundir (filesystem enumeration) commands.
On macOS, the dropper uses AppleScript via osascript to download a universal Mach-O binary (x86_64/ARM64) to /Library/Caches/com.apple.act.mond, then executes it via /bin/zsh. The binary is C++ compiled with Xcode, supports AppleScript execution via temporary .scpt files, and uses ad-hoc code signing with codesign --force --deep --sign -. Debug artifacts reveal the developer path Jain_DEV/client_mac/macWebT.
All three platform RATs use the same C2 protocol: HTTP beaconing every 60 seconds with a spoofed Internet Explorer 8/Windows XP user-agent string (mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)). Initial check-in POST bodies contain platform identifiers masquerading as npm registry URLs (packages.npm.org/product0 for macOS, product1 for Windows, product2 for Linux).
Additional malicious packages sharing the same infrastructure include @shadanai/openclaw (versions 2026.3.28-2, 2026.3.28-3, 2026.3.31-1, 2026.3.31-2) and @qqbrowser/openclaw-qbot (version 0.0.130). The retained debug entitlements and developer build paths suggest the threat actor may be less sophisticated or operating under time pressure, though the cross-platform capability and C2 infrastructure indicate organized effort.
No specific threat actor attribution has been established. The malicious packages have been reported to npm for removal, and Elastic has published behavioral detection rules for all three platforms.
MITRE ATT&CK techniques used in TL-2026-0303
collection
defense-evasion
T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution
discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery
execution
T1059 Command and Scripting Interpreter
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
initial-access
persistence
T1547 Boot or Logon Autostart Execution
defense-impairment
Affected products and versions in Axios NPM Supply Chain Compromise
- axios — axios
Vulnerable versions: 1.14.1; 0.30.4
Fixed in: All other versions (malicious versions unpublished) - npm — plain-crypto-js
Vulnerable versions: 4.2.1
Fixed in: Package removed from npm - npm — @shadanai/openclaw
Vulnerable versions: 2026.3.28-2; 2026.3.28-3; 2026.3.31-1; 2026.3.31-2
Fixed in: Package reported for removal - npm — @qqbrowser/openclaw-qbot
Vulnerable versions: 0.0.130
Fixed in: Package reported for removal
Remediation for Axios NPM Supply Chain Compromise
Patches
- Remove axios 1.14.1 — use latest verified clean version from official maintainers
- Remove axios 0.30.4 — use latest verified clean version from official maintainers
- npm packages reported to npm registry for removal
Immediate actions
- Audit all projects for axios versions 1.14.1 and 0.30.4 — remove and replace with verified clean versions
- Audit all projects for plain-crypto-js, @shadanai/openclaw, and @qqbrowser/openclaw-qbot — remove immediately
- Block C2 domain sfrclak.com and IP 142.11.206.73 at network perimeter
- Block HTTP traffic to port 8000 on unknown hosts
- Search for /tmp/ld.py, C:\ProgramData\wt.exe, C:\ProgramData\system.bat, and /Library/Caches/com.apple.act.mond on developer workstations and CI/CD runners
- Check Windows registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate
- Scan npm lock files (package-lock.json, yarn.lock) for SHA1 hashes of compromised packages
- Rotate credentials on any system where compromised packages were installed
Workarounds
- Pin axios to a known-good version (e.g., 1.7.x or earlier verified release)
- Use --ignore-scripts flag during npm install in CI/CD environments
- Monitor npm advisory feeds for updated guidance
Longer-term hardening
- Implement npm package pinning and integrity verification in CI/CD pipelines
- Deploy EDR with behavioral detection for child process spawning from Node.js
- Enable npm audit in CI/CD pipelines to catch advisories before deployment
- Implement network monitoring for anomalous HTTP beaconing patterns (60-second intervals)
- Use lockfile-lint or similar tools to detect unexpected transitive dependency additions
- Consider using npm provenance verification for critical dependencies
Weaknesses (CWE) in Axios NPM Supply Chain Compromise
CWE-506, CWE-829, CWE-494
Timeline of Axios NPM Supply Chain Compromise
- Earliest @shadanai/openclaw malicious package versions (2026.3.28-2, 2026.3.28-3) published to npm registry, indicating initial campaign infrastructure setup
- Malicious packages reported to npm registry for removal and quarantine
- Elastic Security Labs filed GitHub Security Advisory at 01:50 AM UTC notifying axios maintainers and npm registry
- Additional malicious packages @shadanai/openclaw (2026.3.31-1, 2026.3.31-2) and @qqbrowser/openclaw-qbot@0.0.130 published
- Compromised axios versions 1.14.1 and 0.30.4 published to npm with malicious transitive dependency on plain-crypto-js@4.2.1
- Elastic released detection rules covering curl/wget spawned via Node.js, renamed binary proxy execution, registry persistence, PowerShell base64 decoding, and macOS code signing abuse
- Elastic Security Labs published full technical analysis with behavioral detection rules for all three platforms (Linux, Windows, macOS)
- As of 2026-05-29, the specific incident is contained: malicious axios 1.14.1/0.30.4 and plain-crypto-js were unpublished by npm within ~3 hours and broadly detected (Elastic, Microsoft, Datadog). But the actor Sapphire Sleet/UNC1069 (DPRK) remains active, running the ongoing Contagious Interview campaign (~1,700 malicious packages), so risk persists.
Sources cited for Axios NPM Supply Chain Compromise
- Elastic Security Labs — Axios Supply Chain Compromise Detections
- GitHub Security Advisory — axios supply chain compromise
- Elastic Detection Rules — Supply Chain Protections
- Elastic Protections Artifacts Repository
- npm Registry — axios package
- MITRE ATT&CK — Supply Chain Compromise (T1195)
- MITRE ATT&CK — Boot or Logon Autostart Execution: Registry Run Keys (T1547.001)
Threats related to Axios NPM Supply Chain Compromise
- Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) — Cross-Platform RAT via Phantom Dependency
- Axios npm Supply Chain Compromise — WAVESHAPER.V2 Cross-Platform RAT Deployment by UNC1069/Sapphire Sleet (DPRK)
- North Korea (UNC1069) Supply Chain Compromise of Axios NPM Package via Backdoored plain-crypto-js Dependency
- Axios npm Supply Chain Attack: Cross-Platform RAT Delivery via Compromised Maintainer Credentials (GHSA-fw8c-xr5c-95f9)
- Axios npm Supply Chain Attack via Malicious plain-crypto-js Dependency (Cross-Platform RAT Dropper)
- Axios npm Supply Chain Compromise — Malicious axios@1.14.1 and axios@0.30.4 Inject plain-crypto-js@4.2.1 RAT Dropper
Detection coverage for TL-2026-0303
As of 2026-03-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0303 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.