# Why SBOMs Are Failing to Stop Supply Chain Attacks: XZ Utils Backdoor (CVE-2024-3094) and Axios npm Compromise (March 2026) as Case Studies

> Sysdig's September 2026 analysis argues SBOMs, signatures and attestations could prevent most supply chain attacks but are held back by weak tooling, untrusted developer-provided SBOMs, point-in-time vulnerability data and an inability to detect malicious insiders. It cites the XZ Utils backdoor (CVE-2024-3094) and the March 2026 Axios npm account-takeover, whose RAT payload and network IOCs are documented by Trend Micro and Snyk.

- **Published:** 2026-11-12T01:18:09Z
- **Last reviewed:** 2026-11-12T01:18:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5810
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5810.png
- **ID:** TL-2026-5810
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)
- **CVEs:** CVE-2024-3094

## Description

The Sysdig piece (Javier Martinez, published 2026-09-24) is an analysis, not a new incident report. It argues that an SBOM combined with signatures and attestations provides attribution, provenance and content traceability. Digest-to-attestation matching reveals tampering or impersonation, but it cannot detect a compromised repository or compromised signing keys. Four obstacles are named: inconsistent tool support, SBOMs that cannot be trusted (most registries do not scan images, so their SBOMs are informational), vulnerability data that goes stale after a single scan, and internal threats such as compromised team members or fraudulent hires. The article recommends signing images and attestations, scanning in CI/CD, pairing scanners with Kubernetes admission controllers, continuous rescanning, and dynamic analysis in CI/CD.

XZ Utils (CVE-2024-3094, CVSS 3.1 10.0 per NVD): a contributor, Jia Tan, supplied useful code over years and then introduced a backdoor. The malicious code is in the xz 5.6.0 and 5.6.1 release tarballs, signed by Jia Tan. An obfuscated m4/build-to-host.m4 exists only in the tarballs, not in upstream git. At the end of configure it extracts a payload from two test files committed upstream (tests/files/bad-3-corrupt_lzma2.xz and tests/files/good-large_compressed.lzma). It activates only for x86-64 Linux GNU builds using GCC and GNU ld, and only in Debian/RPM package builds. The injected code replaces the crc32_resolve() and crc64_resolve() IFUNC resolvers, installs a dynamic-linker audit hook, and redirects the RSA_public_decrypt PLT entry in sshd. OpenSSH does not link liblzma directly; the path runs through libsystemd on distributions that patch sshd for systemd notification. Environment checks (TERM unset, argv[0] equal to /usr/sbin/sshd, LD_DEBUG and LD_PROFILE unset) act as anti-analysis. Andres Freund found it through slow SSH logins and valgrind errors on Debian sid. Standard image scanners do not execute code and can miss such payloads.

Axios npm (2026-03-30/31), per Trend Micro and Snyk: attackers hijacked a maintainer's npm account (suspected: jasonsaayman; the account email was changed to ifstap@proton.me). They published axios@1.14.1 and axios@0.30.4 with a hidden dependency, plain-crypto-js@4.2.1, whose postinstall hook (node setup.js) dropped a cross-platform RAT. The 4.2.0 decoy had been published about 18 hours earlier by nrwise@proton.me to build publishing history. setup.js is obfuscated with reversed Base64 and XOR (key OrDeR_7077). It deletes itself and swaps in a clean package.json (renamed from package.md). The RAT beaconed to sfrclak.com:8000 (142.11.206.73) with per-OS payloads: a macOS binary at /Library/Caches/com.apple.act.mond, a Windows PowerShell copy at %PROGRAMDATA%\wt.exe, and a Python RAT at /tmp/ld.py on Linux. The malicious versions were removed from npm at about 03:29-03:30 UTC on March 31. No threat actor was named by the sources. Both case studies show the control gap the article describes: SBOM and attestation checks validate what was published, not whether the publisher was trustworthy.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1195.001 Compromise Software Dependencies and Development Tools
- T1078 Valid Accounts
- T1583.001 Domains
- T1586 Compromise Accounts
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.006 Python
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1480 Execution Guardrails
- T1556 Modify Authentication Process
- T1082 System Information Discovery
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Malicious npm Postinstall Dropper Execution — plain-crypto-js 'node setup.js' / Axios 1.14.1 & 0.30.4 (TL-2026-5810)** (`TL-2026-5810-SPL-001`)

Detects the exploitation step of the March 2026 Axios npm account-takeover supply chain compromise: a Node.js/Bun process running 'setup.js' from the plain-crypto-js@4.2.1 postinstall hook (obfuscated dropper, reversed Base64 + XOR), or a package-manager command line pulling axios@1.14.1, axios@0.30.4 or plain-crypto-js@4.2.1. Behaviour-first: keys on the postinstall execution context (working directory / parent inside plain-crypto-js), not on a hash. Maps to T1195.001, T1195.002 and T1059.007.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1195.002, T1059.007
- **Data sources:** sysmon_windows, sysmon_linux, endpoint_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
((index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") OR (index=linux sourcetype="sysmon:linux")) EventCode=1 earliest=-24h
| eval img=lower(coalesce(Image,"")), cmd=lower(coalesce(CommandLine,"")), cwd=lower(coalesce(CurrentDirectory,"")), pcmd=lower(coalesce(ParentCommandLine,""))
| where ((like(img,"%/node") OR like(img,"%node.exe") OR like(img,"%/bun") OR like(img,"%bun.exe")) AND like(cmd,"%setup.js%") AND (like(cwd,"%plain-crypto-js%") OR like(pcmd,"%plain-crypto-js%"))) OR ((like(cmd,"%npm%") OR like(cmd,"%yarn%") OR like(cmd,"%pnpm%") OR like(cmd,"%bun%")) AND (like(cmd,"%plain-crypto-js@4.2.1%") OR like(cmd,"%axios@1.14.1%") OR like(cmd,"%axios@0.30.4%")))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines values(CurrentDirectory) as working_dirs by host, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let plain_crypto_writes = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has "plain-crypto-js"
    | project DeviceId, WriteTime = Timestamp;
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node", "node.exe", "bun", "bun.exe")
| where ProcessCommandLine has "setup.js"
| join kind=inner plain_crypto_writes on DeviceId
| where Timestamp between (WriteTime .. (WriteTime + 10m))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| sort by Timestamp desc
```

### Sigma

```yaml
title: Malicious npm Postinstall Dropper Execution (plain-crypto-js setup.js)
id: 7c1d0f3a-5b2e-4f6a-9d11-3a8e5c2b7f01
status: experimental
description: Detects Node.js or Bun executing setup.js from the plain-crypto-js postinstall hook, or a package manager invoked with the malicious axios 1.14.1, axios 0.30.4 or plain-crypto-js 4.2.1 versions (Axios npm compromise, March 2026).
references:
  - https://webflow.sysdig.com/blog/why-are-sboms-failing-to-stop-supply-chain-attacks
  - https://www.trendmicro.com/fr_fr/research/26/c/axios-npm-package-compromised.html
  - https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial_access
  - attack.t1195.001
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
detection:
  selection_node:
    Image|endswith:
      - '/node'
      - 'node.exe'
      - '/bun'
      - 'bun.exe'
    CommandLine|contains: 'setup.js'
    CurrentDirectory|contains: 'plain-crypto-js'
  selection_pm:
    CommandLine|contains:
      - 'npm'
      - 'yarn'
      - 'pnpm'
      - 'bun'
  selection_pkg:
    CommandLine|contains:
      - 'plain-crypto-js@4.2.1'
      - 'axios@1.14.1'
      - 'axios@0.30.4'
  condition: selection_node or (selection_pm and selection_pkg)
fields:
  - Image
  - CommandLine
  - CurrentDirectory
  - ParentImage
falsepositives:
  - Legitimate packages whose postinstall runs setup.js from a directory named plain-crypto-js (none known outside this campaign)
  - Security researchers reproducing the Axios compromise in a sandbox
level: high
```

**Known false positives:**

- Security researchers or sandboxes deliberately installing axios@1.14.1, axios@0.30.4 or plain-crypto-js to reproduce the compromise
- Package-mirror or SCA tooling that runs npm view/info against the malicious versions as part of an audit (command line match without execution)

**Tuning notes:** Ensure Sysmon (Windows) and Sysmon for Linux feed the named indexes, and that CurrentDirectory is captured for EventCode 1. Exclude known security-research hosts by host/User. If the build fleet uses an internal registry mirror, also alert on any install of plain-crypto-js regardless of version, since 4.2.0 was a decoy published by the same attacker.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Malicious Package Versions Installed — [indicator], [indicator], plain-crypto-js and Downstream openclaw Packages (locked: unlock with TL Creds)
- XZ Utils Backdoor (CVE-2024-3094) — liblzma 5.6.0/5.6.1 Inventory and Build/Library Artifacts (locked: unlock with TL Creds)
- Axios npm RAT Payload Retrieval — Command Lines Fetching [indicator] or the 6202033 Payload (locked: unlock with TL Creds)
- plain-crypto-js Package Files Written Under node_modules (Axios npm Compromise) (locked: unlock with TL Creds)
- Axios npm RAT on Linux/macOS — [indicator] Python RAT and com.apple.act.mond Binary Execution (locked: unlock with TL Creds)
- Axios npm RAT Proxy Traffic — HTTP Requests to [indicator]:8000/6202033 and Related C2 Hosts (locked: unlock with TL Creds)
- Windows RAT Staging — PowerShell Masquerading as wt.exe in ProgramData and 6202033 PS1/VBS Stages (locked: unlock with TL Creds)
- Axios npm RAT C2 — DNS and Network Connections to [indicator], [indicator] and [indicator]:8000 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `142.11.206[.]73`
- Domain: `sfrclak[.]com`
- File hash: `e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Why are SBOMs failing to stop supply chain attacks? (Sysdig)](https://webflow.sysdig.com/blog/why-are-sboms-failing-to-stop-supply-chain-attacks)
- [NVD: CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094)
- [oss-security: backdoor in upstream xz/liblzma leading to ssh server compromise (Andres Freund)](https://www.openwall.com/lists/oss-security/2024/03/29/4)
- [XZ Utils backdoor (Tukaani Project)](https://tukaani.org/xz-backdoor/)
- [Red Hat advisory CVE-2024-3094](https://access.redhat.com/security/cve/CVE-2024-3094)
- [Sysdig: CVE-2024-3094 detecting the SSHD backdoor in XZ Utils](https://sysdig.com/blog/cve-2024-3094-detecting-the-sshd-backdoor-in-xz-utils/)
- [Trend Micro: axios npm package compromised](https://www.trendmicro.com/fr_fr/research/26/c/axios-npm-package-compromised.html)
- [Snyk: axios npm package compromised, supply chain attack delivers cross-platform RAT](https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/)
- [OX Security: Axios compromised with a malicious dependency](https://www.ox.security/blog/axios-compromised-with-a-malicious-dependency/)
- [Kudelski Security: Axios supply chain attack](https://kudelskisecurity.com/research/axios-supply-chain-attack)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5810