Loading malware…
plain-crypto-js is a malicious npm package used in a March 2026 software supply-chain compromise involving poisoned Axios releases. It masqueraded as a legitimate JavaScript cryptography dependency and was inserted as a hidden dependency into compromised Axios versions so that npm would automatically execute its postinstall hook during installation. Its primary role was to act as a cross-platform remote access trojan dropper targeting Windows, macOS, and Linux systems, including developer workstations, CI/CD runners, and other environments that resolved the affected packages.
The package used obfuscated JavaScript to decode configuration at runtime, identify the host operating system, contact attacker-controlled infrastructure, and retrieve platform-specific second-stage payloads. Reported behaviors include sensitive data collection, host reconnaissance, deployment of platform-dependent backdoors, command-and-control communications, persistence on at least some platforms, and anti-forensic cleanup intended to remove or replace installation artifacts after execution. Recovered payload functionality across platforms included periodic beaconing and support for attacker tasking such as process injection, script execution, directory-based execution, and termination commands.
On Windows, the malware chain used PowerShell-based components and established persistence; on macOS it deployed a Mach-O backdoor; on Linux it deployed a Python-based backdoor. The malware family has been reported as overlapping with WAVESHAPER, and public reporting has linked the broader campaign to North Korea-aligned activity, including attribution by multiple vendors to Sapphire Sleet or UNC1069. Observed impact spanned multiple sectors and regions due to Axios’s widespread use as both a direct and transitive dependency.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These versions introduced a phantom dependency -- plain-crypto-js@4.2.1 ... a package that had not existed before that day and is never actually imported by axios code. Its sole purpose was to execute a postinstall script that drops and runs a cross-platform RAT targeting macOS, Windows, and Linux.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
macOS: The dropper uses AppleScript... launches it silently via /bin/zsh. Windows: ... uses VBScript to fetch and execute a secondary PowerShell RAT script... Linux: The dropper uses the Node.js execSync command to download a Python RAT script...
Windows: The dropper searches for and copies the legitimate Windows PowerShell binary to %PROGRAMDATA%\wt.exe. It then uses VBScript to fetch and execute a secondary PowerShell RAT script, which is subsequently executed by wt.exe.
macOS: The dropper uses AppleScript to download a C++ compiled Mach-O binary, saves it to /Library/Caches/com.apple.act.mond, makes it executable and launches it silently via /bin/zsh.
Windows: ... It then uses VBScript to fetch and execute a secondary PowerShell RAT script...
Linux: The dropper uses the Node.js execSync command to download a Python RAT script to /tmp/ld.py, running it in the background using the nohup command.
plain-crypto-js, which included a postinstall script that ran a setup.js script via node. When developers or CI pipelines run npm install axios@1.14.1, NPM resolves the dependency tree, downloads plain-crypto-js@4.2.1, and runs the postinstall script. Running node setup.js triggers the compromise sequence.
Once installed, npm automatically ran post-install scripts tied to the dependency.
The only change in both malicious Axios versions was a single new dependency: "plain-crypto-js": "^4.2.1" . This package is never imported in the Axios source - it exists solely to run a postinstall hook
This triggers npm's postinstall lifecycle hook, executing a heavily obfuscated Node.js dropper script named setup.js in the background.
a malicious dependency named "plain-crypto-js", an obfuscated dropper that deploys the WAVESHAPER.V2 backdoor
To make this outbound traffic look like benign npm registry requests, it appends platform-specific paths: packages.npm[.]org/product0 for macOS ... All the RAT variants use a hard-coded... user-agent string spoofing Internet Explorer 8 on Windows XP
The C2 server accepts the same four commands from the attacker: kill (self-terminate) runscript (execute shell/script commands) peinject (drop and execute binary payloads) rundir (enumerate directories)
After launching the payload, the dropper erases all evidence - deleting itself, removing the malicious package.json , and swapping in a pre-staged clean manifest.
Upon successfully launching the payload, the Node.js dropper performs aggressive anti-forensic cleanup. It deletes the setup.js file, removes the postinstall hook and replaces the tampered package.json with a clean decoy file named package.md .
After launching the second-stage payload, the installer logic removes its own loader ( setup.js ) and removes the manifest ( package.json ) that contained the install trigger. It then renames package.md to package.json , leaving behind a clean-looking manifest
The only change in both malicious Axios versions was a single new dependency: "plain-crypto-js": "^4.2.1" . This package is never imported in the Axios source - it exists solely to run a postinstall hook
This triggers npm's postinstall lifecycle hook, executing a heavily obfuscated Node.js dropper script named setup.js in the background.
During execution, the malware contacts command-and-control (C2) infrastructure at sfrclak[.]com to deliver platform-specific payloads, then deletes itself and replaces its package.json with a clean version to evade detection.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious dependency injected during the Axios supply-chain compromise; it installed a remote access trojan on impacted environments.
A malicious npm package used in the Axios supply-chain compromise. It executes a postinstall script that drops a cross-platform remote access trojan for macOS, Windows, and Linux, performs reconnaissance, establishes persistence, communicates with a live C2 server, and includes self-deletion for evasion.
A cross-platform remote access trojan introduced via malicious Axios package updates. It was designed to perform system reconnaissance, establish persistence, and then self-destruct to evade forensic detection.
A malicious fake npm dependency inserted into compromised Axios releases that used a postinstall hook to fetch and deploy a cross-platform remote access trojan on Windows, macOS, and Linux.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.