News

The widely used HTTP client Axios was the target of a supply-chain intrusion when two newly released npm versions introduced a hostile dependency that acts as a dropper for a remote access trojan (RAT).

Specifically, [email protected] and [email protected] were found to include a forged dependency, [email protected]. Security researchers at StepSecurity report the malicious releases were pushed using the compromised npm credentials of Axios’s principal maintainer, the account “jasonsaayman,” which allowed attackers to publish bypassing the project’s GitHub Actions CI/CD protections.

The injected package’s only function is to run a postinstall script that deploys a cross-platform RAT. The postinstall dropper determines the victim operating system and retrieves platform-specific second-stage payloads from a command-and-control server. After launching the payload the malware removes itself and swaps the package manifest for a clean one to obscure forensic traces.

Users with [email protected] or [email protected] installed are urged to immediately rotate any secrets or credentials accessed from those environments and to downgrade to the unaffected releases [email protected] or [email protected]. npm has taken down the malicious axios releases and the plain-crypto-js package from the registry.

Axios is one of the JavaScript ecosystem’s most downloaded HTTP libraries - with nearly 100 million weekly installs - and is embedded across front-end frameworks, back-end services and enterprise codebases. StepSecurity characterizes the operation as deliberate and well-prepared: the hostile dependency was staged roughly 18 hours before publication, three distinct payloads were pre-built for macOS, Windows and Linux, both release branches were hit within 39 minutes of each other, and cleanup measures were intentionally implemented to erase evidence.

Timeline of activity reported by StepSecurity:

• March 30, 2026, 05:57 UTC - [email protected] (a clean package) is published.

• March 30, 2026, 23:59 UTC - [email protected], containing the payload, is published.

• March 31, 2026, 00:21 UTC - [email protected] is published and includes [email protected] as a runtime dependency; the release was pushed with the compromised “jasonsaayman” account.

• March 31, 2026, 01:00 UTC - [email protected] is published and likewise injects [email protected], again using the hijacked “jasonsaayman” account.

The investigation indicates the attacker changed the email on the compromised maintainer account to a Proton Mail address (ifstap@proton[.]me). The plain-crypto-js backdoor was published by an npm user “nrwise” with the email nrwise@proton[.]me. The adversary likely obtained a long-lived classic npm access token for the account, enabling direct publication of poisoned Axios packages to the registry.

The embedded malicious logic is delivered by an obfuscated Node.js dropper named “setup.js” and splits execution into three OS-specific routines:

• macOS: the dropper runs an AppleScript that downloads a trojan binary from sfrclak.com:8000, saves it to /Library/Caches/com.apple.act.mond, marks it executable, and launches it via /bin/zsh in the background. The AppleScript is removed after execution to reduce traces.

• Windows: the dropper discovers the system PowerShell path, copies it to %PROGRAMDATA%wt.exe (masquerading as Windows Terminal), writes a VBScript to the temp folder and executes it. The VBScript fetches a PowerShell RAT from the same server and runs it, then deletes the downloaded file.

• Linux/other: the dropper invokes a shell command via Node.js execSync to retrieve a Python RAT from the same host, writes it to /tmp/ld.py, and launches it in the background with nohup.

The security report notes that each platform posts a distinct payload-identifying body to the same command-and-control endpoint so the server can respond with the appropriate binary: packages.npm.org/product0 for macOS, packages.npm.org/product1 for Windows and packages.npm.org/product2 for Linux.

The macOS second-stage is a C++ RAT that fingerprints the host and beacons to its C2 every 60 seconds to fetch commands. It can execute additional payloads, run shell commands, enumerate files, and terminate itself. Neither variant implements persistence across reboots, implying the campaign either seeks rapid data theft or intends to use runtime execution of binaries/commands to later establish persistence.

The attack avoided altering Axios’s own source files, reducing the chances of detection via diff-based code review. The malicious activity lived entirely inside a transitive dependency and was triggered automatically by npm’s postinstall lifecycle.

After delivery, the Node.js dropper attempts several cleanup measures: it removes the postinstall hook from the installed package directory, deletes the package.json that referenced the hook, and renames package.md to package.json. In “plain-crypto-js” the package.md contains a benign package manifest without the postinstall entry; swapping these files helps the package appear clean on inspection post-infection.

Neither compromised Axios release contains any malicious code inside Axios itself - the exploitation was achieved by adding the fake dependency [email protected], a package that Axios does not import, whose sole function is to run the postinstall dropper.

Recommended actions for teams and developers:

• Verify whether your projects have [email protected] or [email protected] installed.
• Look for RAT artifacts on hosts: /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%wt.exe (Windows), /tmp/ld.py (Linux).
• If present, assume systems are compromised: rotate all credentials and secrets accessible from those machines.
• Downgrade Axios to a safe release: [email protected] or [email protected].
• Remove “plain-crypto-js” from node_modules folders where it appears.
• Audit CI/CD pipelines for any runs that installed the affected Axios versions and investigate for signs of downstream exposure.
• Block outbound traffic to the command-and-control domain sfrclak[.]com at network perimeter devices and egress filters.

For developers and security teams, this incident underscores the importance of monitoring maintainers’ account integrity, limiting long-lived registry credentials, scanning transitive dependencies for unusual postinstall actions, and enforcing egress controls that prevent malicious packages from fetching additional payloads.