{"id":287,"date":"2026-04-02T12:53:40","date_gmt":"2026-04-02T07:23:40","guid":{"rendered":"https:\/\/geniushost.net\/blog\/?p=287"},"modified":"2026-04-15T12:15:56","modified_gmt":"2026-04-15T06:45:56","slug":"axios-npm-package-compromised-malware","status":"publish","type":"post","link":"https:\/\/geniushost.net\/blog\/axios-npm-package-compromised-malware\/","title":{"rendered":"Critical Security Alert: Axios npm Package Compromised to Deploy Malware"},"content":{"rendered":"\n

A serious supply chain security attack has been revealed, targeting Axios, <\/strong>one of the most widely used JavaScript HTTP client libraries worldwide. If your applications, CI\/CD pipelines, or development tools depend on npm packages, this threat may directly affect you. The risk can remain even after a standard package update.<\/p>\n\n\n\n

What Happened?<\/h2>\n\n\n\n

On March 30, 2026<\/strong>, a serious supply chain attack hit the official Axios npm package. Researchers discovered that versions 1.14.1 and 0.30.4 of Axios<\/strong>, uploaded to the npm registry, were affected. The attack happened after someone took control of a legitimate maintainer’s account. This allowed the attacker to publish unauthorized package updates that looked completely legitimate to both end users and automated systems.<\/p>\n\n\n\n

These tampered releases added a harmful dependency<\/strong> that runs automatically during installation. This dependency installs a cross-platform Remote Access Trojan (RAT)<\/strong>, putting Windows, macOS, and Linux systems at risk.<\/p>\n\n\n\n

\n

“The affected releases introduced a malicious dependency that executes during installation and deploys a cross\u2011platform remote access trojan (RAT). The malware communicates with a command and control (C2) server to retrieve platform\u2011specific second\u2011stage payloads.”<\/p>\n\u2014 Sophos Counter Threat Unit Research Team<\/cite><\/blockquote>\n\n\n\n

Who Is Behind This Attack?<\/h2>\n\n\n\n

This is not simply a random attack. Research from Sophos Counter Threat Unit (CTU)<\/strong> shows that forensic analysis of the Axios npm breach uncovered evidence closely linked to the NICKEL GLADSTONE<\/strong> threat group, a state-sponsored group<\/strong> aimed at profiting the North Korean regime.<\/p>\n\n\n\n

The evidence linking this attack to NICKEL GLADSTONE includes identical forensic metadata, matching command-and-control (C2) patterns, and ties to malware associated only with this group. Sophos researchers believe it is very likely that NICKEL GLADSTONE is behind these attacks.<\/p>\n\n\n\n

How Does the Malware Work?<\/h2>\n\n\n\n

The attack chain aims to be stealthy and persistent. Here is what occurs after a compromised version of Axios is installed:<\/p>\n\n\n\n

    \n
  1. Installation Trigger:<\/strong> The malicious dependency executes a setup.js<\/code> script automatically during the npm install<\/code> process \u2014 no additional user action required.<\/li>\n\n\n\n
  2. First-Stage Payload:<\/strong> The script reaches out to a C2 server (sfrclak[.]com:8000<\/code>) and downloads a platform-specific first-stage payload (e.g., system.bat<\/code> on Windows).<\/li>\n\n\n\n
  3. Cross-Platform RAT Deployment:<\/strong> Second-stage payloads are then retrieved and executed, a PowerShell RAT on Windows, a Python-based payload (ld.py<\/code>) on Linux, and a daemon (com.apple.act.mond<\/code>) on macOS.<\/li>\n\n\n\n
  4. Evidence Removal: After execution, the Malware removes installation artifacts and replaces its own package metadata with a clean version to actively evade forensic detection.<\/li>\n\n\n\n
  5. Persistence:<\/strong> The Malware establishes persistence mechanisms, particularly on Windows, via C:\\ProgramData\\wt.exe<\/code> and C:\\ProgramData\\system.bat<\/code>.<\/li>\n<\/ol>\n\n\n\n

    This self-cleaning behavior is particularly risky. Just updating the Axios package does not ensure your system is clean<\/strong>. The malware may already have established a lasting presence before you applied any fix.<\/p>\n\n\n\n

    Which Platforms Are Affected?<\/h2>\n\n\n\n

    Sophos first detected activity in customer telemetry at about 00:45 UTC on March 31, 2026<\/strong>. They noted widespread impact by 01:00 UTC. The malware is cross-platform and confirmed to target:<\/p>\n\n\n\n

    \n
    \n

    \ud83e\ude9f Windows<\/h3>\n\n\n\n

    PowerShell-based RAT dropped via system.bat<\/code>. Persists at C:\\ProgramData\\wt.exe<\/code>.<\/p>\n<\/div>\n\n\n\n

    \n

    \ud83c\udf4e macOS<\/h3>\n\n\n\n

    Malicious daemon disguised as com.apple.act.mond<\/code> a legitimate Apple process.<\/p>\n<\/div>\n\n\n\n

    \n

    \ud83d\udc27 Linux<\/h3>\n\n\n\n

    Python-based payload (ld.py<\/code>) deployed for remote access and credential theft.<\/p>\n<\/div>\n<\/div>\n\n\n\n

    Why Should You Care, Even If You Don’t Use Axios Directly?<\/h2>\n\n\n\n

    Axios is one of the most downloaded npm packages in the ecosystem and is used by millions of JavaScript and Node.js projects. The risk isn’t just for developers who directly include Axios in their package.json<\/mark>. Here are some exposure scenarios to think about:<\/p>\n\n\n\n