Quick Read
- Axios versions 1.14.1 and 0.30.4 contain a malicious dependency that deploys a cross-platform RAT.
- The attack, likely conducted by an APT actor, aims for intelligence gathering and credential harvesting rather than financial gain.
- Developers must immediately downgrade to version 1.14.0 or 0.30.3 and rotate all system credentials if compromise is detected.
A high-stakes supply chain attack has targeted the widely used Axios HTTP client, resulting in the distribution of a cross-platform remote access trojan (RAT) through the npm registry. Security researchers at StepSecurity and Socket confirmed that versions 1.14.1 and 0.30.4 of Axios were compromised after attackers gained control of the primary maintainer’s npm account.
Understanding the Axios Compromise and Payload
The attackers bypassed standard security protocols by hijacking the account of maintainer Jason Saayman, allowing them to publish malicious versions of the package directly to npm. This circumvented the project’s established GitHub Actions CI/CD pipeline, making the poisoned versions appear legitimate to many automated systems. According to analysts, the attack was highly coordinated, with the malicious dependency plain-crypto-js being staged 18 hours before the Axios updates were released.
Once installed, the malicious dependency executes a hidden postinstall script designed to drop a RAT tailored to the host operating system. On macOS, the malware fetches a binary and executes it via AppleScript; on Windows, it masquerades as the Terminal application; and on Linux, it deploys a Python-based script. The malware is specifically engineered to cover its tracks by deleting the initial script and restoring a clean version of the package.json file to evade detection during forensic audits.
Stakes and Scope of the Attack
With Axios facilitating hundreds of millions of weekly downloads across major enterprise frameworks, the potential blast radius of this breach is significant. Unlike typical opportunistic attacks involving crypto-miners, this campaign exhibits the hallmarks of an Advanced Persistent Threat (APT). Security experts note that the absence of financial-gain markers suggests the primary objective is intelligence gathering and credential harvesting, with evidence of reconnaissance targeting sensitive .ssh and .aws directories.
Beyond the primary Axios versions, researchers identified that the malicious plain-crypto-js dependency has also been distributed through other packages, including @shadanai/openclaw and @qqbrowser/openclaw-qbot. These findings underscore the danger of vendored dependencies in the modern JavaScript ecosystem.
Immediate Remediation Steps for Developers
Developers are urged to audit their environments immediately. If you have installed Axios versions 1.14.1 or 0.30.4, you must downgrade to versions 1.14.0 or 0.30.3 and remove the plain-crypto-js package from your node_modules directory. Furthermore, security teams should scan network logs for traffic to the command-and-control domain sfrclak.com or the IP address 142.11.206.73. If any artifacts of the RAT are discovered, it must be assumed that the system is compromised, and all credentials, including SSH keys and cloud access tokens, should be rotated immediately.
The precision of the self-destructing forensic cleanup and the strategic staging of the decoy dependency indicate that this breach was a targeted operation rather than a random injection, signaling a shift toward more sophisticated, long-term intelligence gathering tactics within the open-source software supply chain.