Loading story…
Attackers hijacked an Axios maintainer's npm account and published malicious package versions axios@1.14.1 and axios@0.30.4, turning one of npm's most widely used JavaScript libraries into a supply-chain malware delivery channel. The poisoned releases, tracked as MAL-2026-2306 and GHSA-2x9r-6wxq-hrr7, reportedly introduced a hidden dependency, plain-crypto-js@4.2.1, whose postinstall behavior fetched a cross-platform remote access trojan for macOS, Windows, and Linux. The attacker is reported to have used a long-lived classic npm token, changed the maintainer account email, and bypassed the project's normal trusted publishing workflow by releasing directly through the npm CLI.
The malicious packages were available for roughly three hours before removal, but defenders were urged to treat any host or CI runner that installed them as fully compromised. Reported indicators included outbound connections to sfrclak[.]com:8000 and artifacts such as /Library/Caches/com.apple.act.mond on macOS, %PROGRAMDATA%\wt.exe on Windows, and /tmp/ld.py on Linux, with associated infrastructure including 142.11.206.73. Security guidance called for downgrading to axios@1.14.0 or 0.30.3, blocking the command-and-control domain, rebuilding affected systems from known-good images, rotating exposed credentials, and adopting controls such as delayed installation of newly published npm packages and disabling install scripts in CI/CD where feasible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
AWS Security Blog later referenced the March 2026 Axios compromise as a supply-chain incident that a one-day dependency cooldown would have blocked during its short exposure window.
The poisoned Axios releases were taken down from npm roughly two to three hours after publication, limiting but not eliminating exposure for users who installed them.
After compromising an Axios maintainer's npm credentials, attackers published malicious versions axios@1.14.1 and axios@0.30.4 that added plain-crypto-js and installed a cross-platform RAT on macOS, Windows, and Linux systems.
The attacker published plain-crypto-js@4.2.1 at 23:59 UTC, embedding a postinstall hook used to fetch platform-specific malware.
A separate npm account, nrwise, published a clean decoy package plain-crypto-js@4.2.0 to establish publishing history before the Axios compromise.
Security writeups documented the compromise, identified IOCs including sfrclak[.]com and 142.11.206.73, and advised affected organizations to downgrade Axios, inspect hosts and CI runners, rebuild compromised systems, and rotate credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
aws.amazon.com
Open sourcesemgrep.dev
Open sourcelegitsecurity.com
Open sourceosv.dev
Open sourcelinkedin.com
Open sourcesans.org
Open sourcegithub.com
Open sourcelabs.beazley.security
Open sourcestepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers hijacked the npm account of Axios maintainer Jason Saayman and published malicious `axios@1.14.1` and `axios@0.30.4`, bypassing the project’s normal GitHub Actions OIDC publishing flow and adding the staged dependency `plain-crypto-js@4.2.1`. That package’s `postinstall` logic fetched platform-specific payloads from `sfrclak[.]com:8000`, deploying a remote access trojan on Windows, macOS, and Linux while deleting installer artifacts and restoring benign-looking package metadata to hinder detection. The poisoned releases were available for roughly three hours before removal, but Axios’s massive downstream use meant developer workstations, CI/CD pipelines, ephemeral builds, and transitive dependencies could all have resolved the malicious versions during the exposure window. Researchers and vendors including Socket, StepSecurity, Elastic, Huntress, Microsoft, Google Threat Intelligence Group, and others said affected systems should be treated as fully compromised because the malware enabled reconnaissance, command execution, persistence on Windows, payload retrieval, and likely credential theft. Multiple reports tied the operation to a North Korea-linked actor—most prominently `UNC1069`, with other vendors using names such as Sapphire Sleet and STARDUST CHOLLIMA—while Axios later confirmed the maintainer had been compromised through a targeted social-engineering campaign involving fake corporate outreach and a bogus meeting workflow. Organizations were urged to roll back to safe versions such as `1.14.0` or `0.30.3`, remove `plain-crypto-js`, rebuild impacted hosts, rotate all accessible secrets, review lockfiles and CI logs, and block traffic to the identified command-and-control infrastructure.
Aug 6, 2026
A critical vulnerability in the Axios HTTP client library, tracked as **`CVE-2026-40175`**, allows attackers to turn polluted JavaScript object properties into malicious HTTP headers and abuse outbound requests for **SSRF**, **request smuggling**, and potential **remote code execution**. Researchers said the flaw stems from improper header handling in Axios’s HTTP adapter and unsafe config merging, which can let `Object.prototype` values containing CRLF characters be injected into requests. The issue can be chained with prototype pollution in other npm packages to target internal services, including the AWS EC2 metadata endpoint at `169.254.169.254`, potentially bypassing **IMDSv2** and exposing cloud credentials or broader infrastructure. A public proof-of-concept was released alongside disclosure, raising urgency for defenders even though active exploitation had not been confirmed at the time of reporting. The flaw affects Axios versions before **`1.13.2`**, while maintainers said **`1.15.0`** introduces strict header validation that blocks CRLF-based header injection; organizations were urged to upgrade and audit dependencies such as **`body-parser`**, **`qs`**, and **`minimist`** for prototype pollution paths. One report cited internet-wide estimates of more than **48,000** potentially exposed instances, underscoring the risk of unauthorized internal access and possible full cloud compromise.
Jun 29, 2026
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across **Windows via WSL, macOS, and Linux**, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a **WebSocket-based reverse shell**. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to `216.126.225.243` over ports `8085`, `8086`, and `8087`, and included host profiling plus an `HMAC-SHA256` routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with **DPRK-linked OtterCookie** infrastructure. In a separate incident, Socket Threat Research said the widely used npm package **`art-template`** was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions **`4.13.5`** and **`4.13.6`**. The injected code redirected users to a watering-hole framework at `utaq.cfww.shop` that selectively targeted **Safari on iOS 11.0 through 17.2**, beaconed device and IP data to `l1ewsu3yjkqeroy.xyz`, and used anti-bot checks, anti-headless logic, and **WebAssembly-based fingerprinting** before retrieving gated payloads. Researchers found strong overlap with the **Coruna exploit kit**, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at **iOS 17.3**, with additional similarities noted to **UNC6691**.
Jun 29, 2026