Malicious code in axious-core (npm)

The axious-core npm package (version 1.0.0) masquerades as a benign library with no declared functionality but contains a postinstall.js script that acts as a dropper. This script XOR-decodes four opaque byte arrays using the key 'stf2026' to reconstruct a GitHub URL and a shell command. It downloads a Windows executable to the %TEMP% directory and executes it in a detached, hidden manner. The script detects WSL/Linux environments and uses a second XOR-decoded command to launch the Windows binary from Linux via PowerShell/WSL interop, effectively escaping the Linux environment. Concurrently, it sends a JSON payload with the host platform to a hardcoded IP address (193.70.34.101) on port 20099 as an install-success beacon. The use of XOR obfuscation, a bare IP for command and control, and execution of a remote binary during install classify this as a supply-chain malware dropper.

This malicious package can execute arbitrary code on the host system during installation, potentially leading to full system compromise. The dropped executable runs silently and detached, evading user detection. The WSL escape technique allows the attacker to bridge from Linux environments to Windows binaries, increasing the attack surface. The beaconing to attacker infrastructure confirms successful infection and may enable further remote control or data exfiltration. This compromises the integrity of the software supply chain and endangers any systems that install this package.

No official patch or remediation is currently documented. Users should avoid installing axious-core version 1.0.0 and remove it if present. Verify package authenticity before installation and prefer packages from trusted sources. Monitor for any unexpected post-install scripts in npm packages. Since this is a supply-chain dropper, consider scanning development and build environments for this package and related artifacts. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.