Axios npm package compromised to deploy malware

Key Takeaways

• Axios npm package versions 1.14.1 and 0.30.4 were compromised via a maintainer account takeover.
• The compromised packages introduce a malicious dependency that executes during installation.
• The payload deploys a cross-platform remote access trojan (RAT) that fetches second-stage payloads from a C2 server.
• The malware actively evades detection by removing installation artifacts and replacing its own package metadata with a clean version.

Affected Systems

• Node.js applications using Axios versions 1.14.1 and 0.30.4
• Web applications using Axios versions 1.14.1 and 0.30.4
• Developer endpoints and CI/CD pipelines installing the affected packages

Attack Chain

An attacker compromised a legitimate Axios maintainer account and published unauthorized, malicious updates (versions 1.14.1 and 0.30.4) to the npm registry. Upon installation by a victim, a malicious dependency executes and deploys a cross-platform remote access trojan (RAT). The RAT communicates with a command and control (C2) server to download platform-specific second-stage payloads. Finally, the malware deletes installation artifacts and replaces its package metadata with clean versions to evade forensic analysis.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Sophos

Sophos provides endpoint protection signatures (JS/Agent-BLYB, Troj/PSAgent-CN, Troj/PyAgent-BZ, OSX/NukeSped-CB) to detect the threat.

Detection Engineering Assessment

EDR Visibility: Medium — EDR can detect the post-exploitation RAT behavior and second-stage payload execution, but the initial npm install script execution might blend in with normal developer activity. Network Visibility: Medium — Network monitoring could detect the C2 communication for the second-stage payload, provided the C2 indicators are known or the traffic exhibits anomalous patterns. Detection Difficulty: Moderate — The malware actively cleans up artifacts and alters metadata, making forensic detection difficult. Detection relies heavily on catching the installation execution or subsequent C2 traffic.

Required Log Sources

• Process Creation Logs
• Network Connection Logs
• File System Modifications

Hunting Hypotheses

Control Gaps

• Lack of strict package version pinning
• Insufficient monitoring of developer endpoints and CI/CD pipelines

Key Behavioral Indicators

• npm or node processes initiating unexpected outbound network connections
• File deletion events immediately following npm package installations

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Identify and remove Axios versions 1.14.1 and 0.30.4 from all environments.
• Downgrade or upgrade to a known safe version of Axios.

Infrastructure Hardening

• Implement strict dependency pinning and lockfiles to prevent automatic updates to compromised versions.
• Use private npm registries or proxies that scan for known malicious packages.

User Protection

• Ensure endpoint protection is updated with the latest signatures to detect the RAT payloads (e.g., Sophos signatures).

Security Awareness

• Educate developers on the risks of supply chain attacks and the importance of verifying package integrity.

MITRE ATT&CK Mapping

• T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain
• T1078 - Valid Accounts
• T1059 - Command and Scripting Interpreter
• T1105 - Ingress Tool Transfer
• T1070.004 - Indicator Removal: File Deletion

Additional IOCs

• Other:
  • JS/Agent-BLYB - Sophos detection signature for the JavaScript agent
  • Troj/PSAgent-CN - Sophos detection signature for the PowerShell agent
  • Troj/PyAgent-BZ - Sophos detection signature for the Python agent
  • OSX/NukeSped-CB - Sophos detection signature for the macOS NukeSped variant