Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise

Key Takeaways

• The lead maintainer of the Axios npm package was compromised via a highly targeted social engineering campaign.
• Attackers masqueraded as a legitimate company, using a convincing Slack workspace and staged MS Teams meetings to build trust.
• The maintainer was tricked into installing a Remote Access Trojan (RAT) disguised as a required software update for MS Teams.
• The RAT enabled attackers to hijack active browser sessions and cookies, completely bypassing 2FA and OIDC protections.
• Attackers used the hijacked access to publish malicious versions of Axios to npm.

Affected Systems

• macOS
• Windows
• Linux
• npm ecosystem
• Developer endpoints

Attack Chain

Attackers masqueraded as a legitimate company and invited the Axios maintainer to a convincing, branded Slack workspace. They subsequently scheduled an MS Teams meeting and prompted the maintainer to install a fake update to join the call. This update was actually a Remote Access Trojan (RAT) that granted the attackers control over the maintainer's machine. The attackers then hijacked active browser sessions and cookies to bypass 2FA, ultimately using the maintainer's authenticated state to publish malicious versions of the Axios package to npm.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No specific detection rules are provided in the article.

Detection Engineering Assessment

EDR Visibility: High — EDR solutions are highly capable of detecting the execution of unexpected binaries downloaded from browsers or communication apps, as well as unauthorized access to browser cookie stores by unknown processes. Network Visibility: Medium — Network monitoring might catch the initial download of the RAT or subsequent C2 traffic, but the initial social engineering occurred over legitimate, encrypted channels (Slack, MS Teams). Detection Difficulty: Moderate — While the social engineering aspect is difficult to detect technically, the execution of a RAT disguised as an update and subsequent cookie theft are well-known behaviors that standard EDRs should flag if properly configured.

Required Log Sources

• Process Creation Logs (Event ID 4688 / Sysmon Event ID 1)
• File Creation Logs
• Browser Access Logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for suspicious child processes spawned by communication applications (e.g., Slack, MS Teams, web browsers) that write executable files to disk and subsequently execute them.	Process creation and file creation events	Execution	Medium
Monitor for unauthorized or uncommon processes attempting to read browser cookie databases (e.g., Chrome/Edge/Firefox profile directories) to detect potential session hijacking.	File access logs and process monitoring	Credential Access	Low

Control Gaps

• MFA/2FA Bypass via Session Hijacking
• Trust in unverified third-party communications and meeting invites
• Lack of endpoint protection preventing the initial RAT execution

Key Behavioral Indicators

• Unexpected executable downloads prompted during web meetings
• Unknown processes accessing browser cookie stores
• Abnormal child processes originating from MS Teams or Slack

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Audit npm and GitHub logs for unauthorized access or publishing events.
• Revoke all active sessions, clear cookies, and rotate credentials if a compromise is suspected.
• Wipe and reformat any devices suspected of being compromised by a RAT.

Infrastructure Hardening

• Implement hardware security keys (FIDO2) for all critical accounts to mitigate phishing.
• Enforce strict device management and endpoint protection (EDR) on maintainer machines.

User Protection

• Deploy EDR solutions to monitor for suspicious file executions and cookie theft.
• Isolate open-source maintenance environments (e.g., using VMs or dedicated devices) from general web browsing and communications.

Security Awareness

• Train developers and maintainers on advanced social engineering tactics, including fake company personas, cloned identities, and staged meetings.
• Establish strict verification protocols for new corporate partnerships, collaborations, or software update prompts during meetings.

MITRE ATT&CK Mapping

• T1566.002 - Phishing: Spearphishing Link
• T1204.002 - User Execution: Malicious File
• T1539 - Steal Session Cookie
• T1185 - Browser Session Hijacking
• T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain