Threat Brief: Widespread Impact of the Axios Supply Chain Attack
Summary: Unit 42 reported a supply chain attack on the Axios JavaScript library after an Axios maintainer's npm account was hijacked, publishing malicious versions v1.14.1 and v0.30.4 that injected a hidden dependency, plain-crypto-js@4.2.1, into package.json. Running npm install triggers a postinstall hook that executes an obfuscated Node.js dropper, setup.js, which contacts a command-and-control server at sfrclak[.]com:8000 and delivers a cross-platform remote access Trojan for Windows, macOS and Linux, with the whole process from installation to compromise taking roughly 15 seconds.
What you should know: The malware analysis overlaps with operations previously reported to involve the Democratic People's Republic of Korea, and the dropper deletes setup.js and replaces the tampered package.json with a clean decoy file named package.md, so developers inspecting node_modules afterward find no obvious sign of compromise.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026