WAVESHAPER.V2
WAVESHAPER.V2 is a cross-platform remote access trojan/backdoor deployed in the March 2026 Axios npm supply-chain compromise. Malicious Axios versions 1.14.1 and 0.30.4 pulled in the phantom dependency plain-crypto-js, whose obfuscated postinstall dropper deployed WAVESHAPER.V2 on Windows, macOS, and Linux during package installation. Reporting describes platform-specific variants for macOS (native C++/Mach-O), Windows (PowerShell), and Linux (Python). The malware is described as a fully functional RAT capable of reconnaissance and system telemetry collection, including hostname, username, boot time, time zone, OS version, and running process lists; command execution, including arbitrary shell commands and in-memory PE injection; file system and directory enumeration with detailed metadata; and retrieval/execution of additional payloads. WAVESHAPER.V2 communicates with command-and-control infrastructure using Base64-encoded JSON and polls at 60-second intervals; multiple reports identify sfrclak[.]com and 142.11.206.73 as associated C2 infrastructure. On Windows, reported persistence includes creation of a hidden batch file at %PROGRAMDATA%\system.bat and a Run key named MicrosoftUpdate under HKCU\Software\Microsoft\Windows\CurrentVersion\Run; related Windows artifacts also include %PROGRAMDATA%\wt.exe and temporary script files such as %TEMP%\6202033.vbs and %TEMP%\6202033.ps1. Reported macOS and Linux payload locations include /Library/Caches/com.apple.act.mond and /tmp/ld.py. Google Threat Intelligence Group and other reporting assess WAVESHAPER.V2 as an updated evolution of the earlier WAVESHAPER backdoor and attribute its use in this campaign to UNC1069, a financially motivated North Korea-linked threat actor with prior cryptocurrency-sector targeting. High-confidence indicators mentioned in the content include plain-crypto-js versions 4.2.0/4.2.1 in dependency trees, node_modules/plain-crypto-js/setup.js, sfrclak[.]com, and 142.11.206.73.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These versions included a phantom dependency called "plain crypto js" that executed an obfuscated dropper during installation, deploying a cross platform Remote Access Trojan known as WAVESHAPER.V2 across Windows, macOS, and Linux systems.
This includes the poisoning of the popular Axios npm package to distribute an implant called WAVESHAPER.V2 after taking control of the package maintainer's npm account via a tailored social engineering campaign.
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
after taking control of the package maintainer's npm account via a tailored social engineering campaign
On March 31, 2026, threat actors compromised the lead maintainer's npm account and published malicious versions 1.14.1 and 0.30.4. These versions included a phantom dependency called "plain crypto js" that executed an obfuscated dropper during installation, deploying a cross platform Remote Access Trojan known as WAVESHAPER.V2 across Windows, macOS, and Linux systems.
These versions included a phantom dependency called "plain crypto js" that executed an obfuscated dropper during installation, deploying a cross platform Remote Access Trojan known as WAVESHAPER.V2 across Windows, macOS, and Linux systems.
Execution
8 techniques
Execution
capable of... command execution... and arbitrary shell commands
The shell execution command expects a script and script parameters from C2; if no script is provided, the parameter is executed as a PowerShell command...
Command Execution: Supports multiple execution methods, including in-memory Portable Executable (PE) injection and arbitrary shell commands.
macOS: Downloads a C++ Mach-O binary, stores it in /Library/Caches/com.apple.act.mond, and executes it via /bin/zsh.
Windows: Copies PowerShell to %PROGRAMDATA%\wt.exe, disguising it as Windows Terminal, and executes a secondary script via VBScript with registry-based persistence.
Linux: Retrieves a Python-based implant to /tmp/ld.py and executes it in the background using nohup.
Persistence
2 techniques
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
6 techniques
Stealth
a malicious dependency named "plain-crypto-js", an obfuscated dropper that deploys the WAVESHAPER.V2 backdoor
capable of... command execution (in-memory Portable Executable injection and arbitrary shell commands)
Within seconds of execution, the dropper deletes the setup script, removes the postinstall hook, and replaces modified package files with benign decoys.
after taking control of the package maintainer's npm account via a tailored social engineering campaign
Credential Access
1 technique
Credential Access
Discovery
3 techniques
Discovery
Reconnaissance: Extracts system telemetry, including hostname, username, boot time, time zone, OS version, and detailed running process lists.
Collection
1 technique
Collection
Command and Control
3 techniques
Command and Control
WAVESHAPER.V2 communicates using JSON... both versions accept their C2 URL dynamically via command-line arguments, share identical C2 polling behaviors and an uncommon User-Agent string...
IOCs tracked for this family
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A cross-platform backdoor delivered via the malicious plain-crypto-js dependency in poisoned Axios package versions, capable of infecting Windows, macOS, and Linux systems.
A cross-platform remote access trojan deployed via an obfuscated dropper during the malicious Axios npm supply-chain compromise, affecting Windows, macOS, and Linux systems.
An implant distributed via a compromised Axios npm package following maintainer account takeover through social engineering.
A cross-platform remote access trojan framework delivered via a malicious Axios npm dependency. It supports persistence, reconnaissance, beaconing to C2 every 60 seconds, remote command execution, payload delivery, directory enumeration, and self-termination across macOS, Windows, and Linux.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.