Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5810 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Malicious npm Postinstall Dropper Execution — plain-crypto-js 'node setup.js' / Axios 1.14.1 & 0.30.4 (TL-2026-5810)

Detects the exploitation step of the March 2026 Axios npm account-takeover supply chain compromise: a Node.js/Bun process running 'setup.js' from the plain-crypto-js@4.2.1 postinstall hook (obfuscated dropper, reversed Base64 + XOR), or a package-manager command line pulling axios@1.14.1, axios@0.30.4 or plain-crypto-js@4.2.1. Behaviour-first: keys on the postinstall execution context (working directory / parent inside plain-crypto-js), not on a hash. Maps to T1195.001, T1195.002 and T1059.007.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1195.002, T1059.007
• Data sources: sysmon_windows, sysmon_linux, endpoint_process_creation
• Severity: high
• Confidence: high

Splunk SPL

((index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") OR (index=linux sourcetype="sysmon:linux")) EventCode=1 earliest=-24h
| eval img=lower(coalesce(Image,"")), cmd=lower(coalesce(CommandLine,"")), cwd=lower(coalesce(CurrentDirectory,"")), pcmd=lower(coalesce(ParentCommandLine,""))
| where ((like(img,"%/node") OR like(img,"%node.exe") OR like(img,"%/bun") OR like(img,"%bun.exe")) AND like(cmd,"%setup.js%") AND (like(cwd,"%plain-crypto-js%") OR like(pcmd,"%plain-crypto-js%"))) OR ((like(cmd,"%npm%") OR like(cmd,"%yarn%") OR like(cmd,"%pnpm%") OR like(cmd,"%bun%")) AND (like(cmd,"%plain-crypto-js@4.2.1%") OR like(cmd,"%axios@1.14.1%") OR like(cmd,"%axios@0.30.4%")))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines values(CurrentDirectory) as working_dirs by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let plain_crypto_writes = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has "plain-crypto-js"
    | project DeviceId, WriteTime = Timestamp;
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node", "node.exe", "bun", "bun.exe")
| where ProcessCommandLine has "setup.js"
| join kind=inner plain_crypto_writes on DeviceId
| where Timestamp between (WriteTime .. (WriteTime + 10m))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| sort by Timestamp desc

Sigma

title: Malicious npm Postinstall Dropper Execution (plain-crypto-js setup.js)
id: 7c1d0f3a-5b2e-4f6a-9d11-3a8e5c2b7f01
status: experimental
description: Detects Node.js or Bun executing setup.js from the plain-crypto-js postinstall hook, or a package manager invoked with the malicious axios 1.14.1, axios 0.30.4 or plain-crypto-js 4.2.1 versions (Axios npm compromise, March 2026).
references:
  - https://webflow.sysdig.com/blog/why-are-sboms-failing-to-stop-supply-chain-attacks
  - https://www.trendmicro.com/fr_fr/research/26/c/axios-npm-package-compromised.html
  - https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial_access
  - attack.t1195.001
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
detection:
  selection_node:
    Image|endswith:
      - '/node'
      - 'node.exe'
      - '/bun'
      - 'bun.exe'
    CommandLine|contains: 'setup.js'
    CurrentDirectory|contains: 'plain-crypto-js'
  selection_pm:
    CommandLine|contains:
      - 'npm'
      - 'yarn'
      - 'pnpm'
      - 'bun'
  selection_pkg:
    CommandLine|contains:
      - 'plain-crypto-js@4.2.1'
      - 'axios@1.14.1'
      - 'axios@0.30.4'
  condition: selection_node or (selection_pm and selection_pkg)
fields:
  - Image
  - CommandLine
  - CurrentDirectory
  - ParentImage
falsepositives:
  - Legitimate packages whose postinstall runs setup.js from a directory named plain-crypto-js (none known outside this campaign)
  - Security researchers reproducing the Axios compromise in a sandbox
level: high

Known false positives:

• Security researchers or sandboxes deliberately installing axios@1.14.1, axios@0.30.4 or plain-crypto-js to reproduce the compromise
• Package-mirror or SCA tooling that runs npm view/info against the malicious versions as part of an audit (command line match without execution)

Tuning notes: Ensure Sysmon (Windows) and Sysmon for Linux feed the named indexes, and that CurrentDirectory is captured for EventCode 1. Exclude known security-research hosts by host/User. If the build fleet uses an internal registry mirror, also alert on any install of plain-crypto-js regardless of version, since 4.2.0 was a decoy published by the same attacker.

• 🔒 Malicious Package Versions Installed — [indicator], [indicator], plain-crypto-js and Downstream openclaw Packages · unlock with TL Creds
• 🔒 XZ Utils Backdoor (CVE-2024-3094) — liblzma 5.6.0/5.6.1 Inventory and Build/Library Artifacts · unlock with TL Creds
• 🔒 Axios npm RAT Payload Retrieval — Command Lines Fetching [indicator] or the 6202033 Payload · unlock with TL Creds
• 🔒 plain-crypto-js Package Files Written Under node_modules (Axios npm Compromise) · unlock with TL Creds
• 🔒 Axios npm RAT on Linux/macOS — [indicator] Python RAT and com.apple.act.mond Binary Execution · unlock with TL Creds
• 🔒 Axios npm RAT Proxy Traffic — HTTP Requests to [indicator]:8000/6202033 and Related C2 Hosts · unlock with TL Creds
• 🔒 Windows RAT Staging — PowerShell Masquerading as wt.exe in ProgramData and 6202033 PS1/VBS Stages · unlock with TL Creds
• 🔒 Axios npm RAT C2 — DNS and Network Connections to [indicator], [indicator] and [indicator]:8000 · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5810.

Sample indicators (3 of 29)

• IP address: 142.11.206[.]73
• Domain: sfrclak[.]com
• File hash: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Community OSINT corroboration

7 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

The Sysdig piece (Javier Martinez, published 2026-09-24) is an analysis, not a new incident report. It argues that an SBOM combined with signatures and attestations provides attribution, provenance and content traceability. Digest-to-attestation matching reveals tampering or impersonation, but it cannot detect a compromised repository or compromised signing keys. Four obstacles are named: inconsistent tool support, SBOMs that cannot be trusted (most registries do not scan images, so their SBOMs are informational), vulnerability data that goes stale after a single scan, and internal threats such as compromised team members or fraudulent hires. The article recommends signing images and attestations, scanning in CI/CD, pairing scanners with Kubernetes admission controllers, continuous rescanning, and dynamic analysis in CI/CD.

XZ Utils (CVE-2024-3094, CVSS 3.1 10.0 per NVD): a contributor, Jia Tan, supplied useful code over years and then introduced a backdoor. The malicious code is in the xz 5.6.0 and 5.6.1 release tarballs, signed by Jia Tan. An obfuscated m4/build-to-host.m4 exists only in the tarballs, not in upstream git. At the end of configure it extracts a payload from two test files committed upstream (tests/files/bad-3-corrupt_lzma2.xz and tests/files/good-large_compressed.lzma). It activates only for x86-64 Linux GNU builds using GCC and GNU ld, and only in Debian/RPM package builds. The injected code replaces the crc32_resolve() and crc64_resolve() IFUNC resolvers, installs a dynamic-linker audit hook, and redirects the RSA_public_decrypt PLT entry in sshd. OpenSSH does not link liblzma directly; the path runs through libsystemd on distributions that patch sshd for systemd notification. Environment checks (TERM unset, argv[0] equal to /usr/sbin/sshd, LD_DEBUG and LD_PROFILE unset) act as anti-analysis. Andres Freund found it through slow SSH logins and valgrind errors on Debian sid. Standard image scanners do not execute code and can miss such payloads.

Axios npm (2026-03-30/31), per Trend Micro and Snyk: attackers hijacked a maintainer's npm account (suspected: jasonsaayman; the account email was changed to ifstap@proton.me). They published axios@1.14.1 and axios@0.30.4 with a hidden dependency, plain-crypto-js@4.2.1, whose postinstall hook (node setup.js) dropped a cross-platform RAT. The 4.2.0 decoy had been published about 18 hours earlier by nrwise@proton.me to build publishing history. setup.js is obfuscated with reversed Base64 and XOR (key OrDeR_7077). It deletes itself and swaps in a clean package.json (renamed from package.md). The RAT beaconed to sfrclak.com:8000 (142.11.206.73) with per-OS payloads: a macOS binary at /Library/Caches/com.apple.act.mond, a Windows PowerShell copy at %PROGRAMDATA%\wt.exe, and a Python RAT at /tmp/ld.py on Linux. The malicious versions were removed from npm at about 03:29-03:30 UTC on March 31. No threat actor was named by the sources. Both case studies show the control gap the article describes: SBOM and attestation checks validate what was published, not whether the publisher was trustworthy.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails

Execution

T1059.001 PowerShell; T1059.005 Visual Basic; T1059.006 Python; T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Initial Access

T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Discovery

T1082 System Information Discovery

Persistence

T1554 Compromise Host Software Binary

Credential Access

T1556 Modify Authentication Process

Resource Development

T1583.001 Domains; T1586 Compromise Accounts

Remediation

Patches

• Pin axios to 1.14.0 (1.x) or 0.30.3 (0.x) or any other non-malicious release
• Upgrade xz beyond 5.6.1 to clean releases (downgrade from 5.6.0/5.6.1)

Immediate actions

• Search package-lock.json, yarn.lock and bun.lock for axios 1.14.1, axios 0.30.4 and plain-crypto-js; run npm ls plain-crypto-js
• Block sfrclak.com, callnrwise.com and 142.11.206.73 at DNS/network egress
• Hunt hosts for /Library/Caches/com.apple.act.mond, %PROGRAMDATA%\wt.exe and /tmp/ld.py
• If affected: isolate hosts, rebuild from a clean image, and rotate npm/GitHub tokens, cloud keys, SSH keys and CI/CD secrets

Workarounds

• Use overrides/resolutions in package.json to block the malicious axios versions
• Remove plain-crypto-js and reinstall with --ignore-scripts

Longer-term hardening

• Sign images and attestations and verify digests before deployment
• Scan images in CI/CD and block policy violations; pair scanners with a Kubernetes admission controller
• Rescan continuously and check scan dates on SBOM-declared vulnerabilities
• Add dynamic analysis in CI/CD to detect malicious insiders and anomalous package behavior
• Use npm ci with committed lockfiles and --ignore-scripts in CI; monitor phantom dependencies and CI/CD egress

Affected and fixed versions

• Tukaani Project — XZ Utils (xz/liblzma)
  Vulnerable versions: 5.6.0; 5.6.1
  Fixed in: 5.6.2 and later clean releases
• Axios (npm) — axios
  Vulnerable versions: 1.14.1; 0.30.4
  Fixed in: 1.14.0 and earlier 1.x; 0.30.3 and earlier 0.x
• npm ecosystem — plain-crypto-js
  Vulnerable versions: 4.2.1
  Fixed in: remove package; 4.2.0 was a decoy published by the attacker account

Timeline

• 2024-03-29 Andres Freund discloses on oss-security a backdoor in the xz/liblzma 5.6.0 and 5.6.1 release tarballs; Red Hat assigns CVE-2024-3094 (CVSS 10.0 in NVD).
• 2024-03-30 The xz@tukaani.org address stops forwarding to Jia Tan, per the Tukaani Project.
• 2024-04-02 Lasse Collin's suspended GitHub account is reinstated.
• 2024-05-29 Tukaani publishes review notes v1.0 and issues clean XZ Utils releases.
• 2026-03-30 Decoy plain-crypto-js@4.2.0 published at 05:57 UTC by locked-ioc-16; locked-ioc-21 registered at 16:03 UTC; malicious plain-crypto-js@4.2.1 published at about 23:59 UTC.
• 2026-03-31 npm removes both malicious axios versions at about 03:29-03:30 UTC and revokes tokens.
• 2026-03-31 axios@1.14.1 published at 00:21 UTC and axios@0.30.4 at 01:00 UTC via a hijacked maintainer npm account; scanners flagged plain-crypto-js at about 00:05 UTC.
• 2026-09-24 Sysdig publishes analysis of why SBOMs, signatures and attestations fail to stop supply chain attacks, citing XZ Utils and Axios.

Sources cited

• NVD: CVE-2024-3094 NVD (NIST) · Advisory · 2024-03-29
• oss-security: backdoor in upstream xz/liblzma leading to ssh server compromise (Andres Freund) openwall.com · Research · 2024-03-29
• XZ Utils backdoor (Tukaani Project) tukaani.org · Vendor report · 2024-03-30
• Red Hat advisory CVE-2024-3094 access.redhat.com · Vendor report · 2024-03-29
• Trend Micro: axios npm package compromised Trend Micro · Research · 2026-03-31
• Kudelski Security: Axios supply chain attack kudelskisecurity.com · Research · 2026-03-31
• Why are SBOMs failing to stop supply chain attacks? (Sysdig) webflow.sysdig.com · Blog · 2026-09-24
• Sysdig: CVE-2024-3094 detecting the SSHD backdoor in XZ Utils sysdig.com · Blog · 2024-03-29
• Snyk: axios npm package compromised, supply chain attack delivers cross-platform RAT snyk.io · Blog · 2026-03-31
• OX Security: Axios compromised with a malicious dependency ox.security · Blog · 2026-03-31

More in supply chain

• Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)
• Software Supply Chain Attacks Weaponizing Trusted Developer Workflows (Shai-Hulud, Miasma, Hades, TeamPCP)
• Active ScreenConnect Attacks Breach MSPs via Run Command, Deploying Rogue ScreenConnect Clients Across Dozens of Organizations
• MCP Server Supply Chain Weaknesses (uvx/npx Unpinned Dependencies) Could Expose API Keys and Administrator Credentials
• AI Is Both Target and Tool for Threat Actors: AI-Involved Supply-Chain, Malware and Extortion Trends (Insikt Group, Jul 2025 - Jul 2026)

Other reports on CVE-2024-3094

• SDLC Supply Chain Attacks: ChainDrop npm Worm and Developer Pipeline Targeting
• 36-Month Precision Supply Chain Campaign Targeting DevSecOps Infrastructure (CVE-2024-3094, CVE-2025-30066, CVE-2025-30154)

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages
• TeamPCP Supply Chain Attack on Trivy, LiteLLM