CampaignPublished 1 Apr 2026

Inside the Axios supply chain compromise · one RAT to rule them all

Source AlienVault OTX General

Description

Elastic Security Labs identified a supply chain compromise of the axios npm package, one of the most depended-upon packages in the JavaScript ecosystem with approximately 100 million weekly downloads. The attacker compromised a maintainer account and published backdoored versions that delivered a cross-platform Remote Access Trojan to macOS, Windows, and Linux systems through a malicious postinstall hook.

Impact

The compromise of axios, a foundational npm package, poses a severe risk to the global software development ecosystem. Organizations that incorporate axios into their applications or development environments may unknowingly introduce a Remote Access Trojan, leading to unauthorized access to internal systems across multiple operating systems. This can result in data breaches, intellectual property theft, disruption of development pipelines, and potential supply chain contamination affecting downstream users and customers. The cross-platform nature of the RAT increases the attack surface, impacting diverse environments including servers, developer workstations, and CI/CD systems. The trust erosion in npm packages could lead to broader supply chain insecurity, affecting software integrity and reliability. Although currently rated medium severity, the potential for escalation to critical exists if attackers leverage the RAT for widespread espionage, ransomware deployment, or destructive attacks. The attack also highlights the vulnerability of open-source ecosystems to maintainer account compromises, which can have cascading effects on global software supply chains.

Defensive guidance

1. Immediately audit all projects and environments for the presence of the compromised axios versions, focusing on recent package updates and installations. 2. Revert to a known clean version of axios or temporarily remove axios dependencies until a verified patched version is released. 3. Implement strict access controls and multi-factor authentication (MFA) on all package maintainer accounts to prevent unauthorized publishing. 4. Employ software composition analysis (SCA) tools to detect and block malicious or unexpected postinstall scripts in npm packages. 5. Monitor network traffic for connections to known malicious domains such as sfrclak.com and investigate any suspicious communications. 6. Use endpoint detection and response (EDR) solutions to identify behaviors consistent with RAT activity, including unusual process executions and persistence mechanisms. 7. Educate developers and DevOps teams on supply chain risks and encourage verification of package integrity using cryptographic signatures or checksums. 8. Collaborate with npm and open-source communities to improve package publishing security and rapid incident response capabilities. 9. Establish incident response plans specifically addressing supply chain compromises to enable swift containment and remediation. 10. Regularly update and patch all development and production systems to reduce exposure to secondary exploits leveraged by the RAT.

Indicators of compromise

Domains 1

sfrclak.com

Hashes 7

04e3073b3cd5c5bfcde6f575ecf6e8c1
7a9ddef00f69477b96252ca234fcbeeb
13ab317c5dcab9af2d1bdb22118b9f09f8a4038e
a90c26e7cbb3440ac1cad75cf351cbedef7744a8
617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101
92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a
fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Apr 2026, 12:14 UTC

MITRE ATT&CK techniques3 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 7

Community reviews

Related threats