# Axios NPM Supply Chain Compromise — Cross-Platform RAT via Malicious Transitive Dependency (plain-crypto-js)

> A supply chain attack compromised axios npm package versions 1.14.1 and 0.30.4 through a malicious transitive dependency (plain-crypto-js@4.2.1). The attack deploys cross-platform RATs targeting Linux, Windows, and macOS via npm postinstall script execution, with C2 infrastructure at sfrclak.com (142.11.206.73). Axios is one of npm's most downloaded packages with approximately 60 million weekly downloads, making this a high-impact supply chain event.

- **Published:** 2026-03-31T12:00:00Z
- **Last reviewed:** 2026-03-31T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0303
- **ID:** TL-2026-0303
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 31, 2026, Elastic Security Labs identified and reported a supply chain compromise affecting the widely-used axios npm package. The attack introduced malicious code through a transitive dependency injection strategy, where compromised axios versions 1.14.1 and 0.30.4 added a dependency on a malicious package named plain-crypto-js@4.2.1.

The attack chain begins during npm's postinstall phase, when plain-crypto-js's setup.js script executes automatically. This script acts as a platform-aware dropper, spawning OS-native interpreters to retrieve and execute second-stage payloads from the C2 server at sfrclak.com over HTTP port 8000.

On Linux, the dropper uses /bin/sh to invoke curl, downloading a Python-based RAT to /tmp/ld.py. The RAT runs detached via nohup, polls the C2 every 60 seconds, and supports runscript (shell/Python execution) and peinject (payload execution) commands. It reports hostname, username, OS, and process list during initial check-in.

On Windows, the attack renames PowerShell to C:\ProgramData\wt.exe to evade detection, then downloads 6202033.ps1 — a PowerShell-based RAT. Persistence is achieved via a registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate) that executes C:\ProgramData\system.bat on login. The RAT uses in-memory .NET assembly injection via Assembly.Load(byte[]) and supports peinject (.NET injection), runscript (PowerShell), and rundir (filesystem enumeration) commands.

On macOS, the dropper uses AppleScript via osascript to download a universal Mach-O binary (x86_64/ARM64) to /Library/Caches/com.apple.act.mond, then executes it via /bin/zsh. The binary is C++ compiled with Xcode, supports AppleScript execution via temporary .scpt files, and uses ad-hoc code signing with codesign --force --deep --sign -. Debug artifacts reveal the developer path Jain_DEV/client_mac/macWebT.

All three platform RATs use the same C2 protocol: HTTP beaconing every 60 seconds with a spoofed Internet Explorer 8/Windows XP user-agent string (mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)). Initial check-in POST bodies contain platform identifiers masquerading as npm registry URLs (packages.npm.org/product0 for macOS, product1 for Windows, product2 for Linux).

Additional malicious packages sharing the same infrastructure include @shadanai/openclaw (versions 2026.3.28-2, 2026.3.28-3, 2026.3.31-1, 2026.3.31-2) and @qqbrowser/openclaw-qbot (version 0.0.130). The retained debug entitlements and developer build paths suggest the threat actor may be less sophisticated or operating under time pressure, though the cross-platform capability and C2 infrastructure indicate organized effort.

No specific threat actor attribution has been established. The malicious packages have been reported to npm for removal, and Elastic has published behavioral detection rules for all three platforms.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1553 Subvert Trust Controls
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1005 Data from Local System

## Sources

- [Elastic Security Labs — Axios Supply Chain Compromise Detections](https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections)
- [GitHub Security Advisory — axios supply chain compromise](https://github.com/advisories)
- [Elastic Detection Rules — Supply Chain Protections](https://github.com/elastic/detection-rules)
- [Elastic Protections Artifacts Repository](https://github.com/elastic/protections-artifacts)
- [npm Registry — axios package](https://www.npmjs.com/package/axios)
- [MITRE ATT&CK — Supply Chain Compromise (T1195)](https://attack.mitre.org/techniques/T1195/)
- [MITRE ATT&CK — Boot or Logon Autostart Execution: Registry Run Keys (T1547.001)](https://attack.mitre.org/techniques/T1547/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0303