Incident Overview
On March 31, 2026, two malicious versions of Axios, 1.14.1 and 0.30.4, were published to the npm package registry and injected with a malicious dependency that downloaded a second-stage RAT on both Windows, MacOS, and Linux systems. Security vendors attribute the attack to one of North Korea's financially motivated state actors, such as UNC1069. Below you can see a summarized incident timeline:
| # |
Attack Stage |
Description |
| 1 |
Social Engineering |
Attackers compromise a lead Axios maintainer's npm account via social engineering |
| 2 |
Resource Development |
Attackers stage a fake package (plain-crypto-js@4.2.0) 18 hours before the attack |
| 3 |
Backdoor Creation |
Attackers publish the malicious plain-crypto-js@4.2.1 with a hidden postinstall hook |
| 4 |
Dependency Injection |
Attackers release axios@1.14.1 and axios@0.30.4 and add plain-crypto-js@4.2.1 as a dependency |
| 5 |
Supply Chain Attack |
Once a developer installs or updates Axios (e.g., with npm install), the new dependency is picked up:
- The postinstall hook
node setup.js executes automatically
- The payload deploys a RAT (Windows / macOS / Linux)
- The installer replaces
setup.js with a clean decoy file
|
| 6 |
C2 Establishment |
The RAT is then used to steal secrets or gain access to the internal network |
The next paragraphs highlight some of the most interesting attack phases and observations.
(1) Social Engineering
The compromise began with a social engineering attack on the Axios maintainer, jasonsaayman. Attackers posed as a trusted company and invited him into a corporate Slack channel. After gaining his trust, they sent a fake Microsoft Teams meeting link and used a ClickFix approach, displaying a fake system error with instructions to "fix" it by entering malicious OS commands. Following those instructions, jasonsaayman silently installed a data stealer, which harvested his npm access token.
This is a good indicator of how complex targeted attacks have become, as the adversaries would have to:
- Research the interests and relations of the Axios maintainer
- Create a convincing company profile and social media presence
- Work as a group to make the Slack workspace appear legitimate
- Build the appropriate ClickFix infrastructure
(4) Dependency Injection
You might wonder why the attackers didn't just backdoor the Axios source code directly; why go through the trouble of creating a fake dependency and triggering it with a postinstall hook? There are at least two reasons:
- To make the attack payload more modular and easier to modify and/or self-destruct after execution
- To draw less attention, as the Axios source code is more likely to be monitored than its dependencies
(Image template credit: XKCD)
(6) Unsophisticated RATs
The initial attack stages are fairly sophisticated, with significant effort spent on building trust during social engineering, developing attack infrastructure, and obfuscating the JavaScript payload. On the other hand, the final stage is much easier to detect and analyze. For example:
- The Linux RAT is a simple Python script that does not persist on the system
- The Windows RAT is a PowerShell script persisting via the Run registry key
- The MacOS RAT is a non-stripped binary, trivial to reverse engineer
- The C2 communicates over HTTP to a hardcoded URL (hxxp://sfrclak[.]com:8000/6202033)
- The code contains multiple bugs and grammatical mistakes across all platforms. For example:
This pattern shows up in many recent attacks. Once the initial stage succeeds without triggering any security controls, attackers assume the defenses weren't there, and the hard part is over. Therefore, they stop putting effort into hiding what comes next: the minimally needed C2 infrastructure to steal the data and gain remote control over the victims.
Incident Impact
Between ~00:21 and ~03:15 UTC, anyone who updated Axios to the latest version received a RAT alongside it: students learning JavaScript, independent developers, and big organizations using Axios in corporate applications. There are no public records of which companies were compromised, but the full attack impact may not be felt for some time:
- The credentials stolen by RAT may be placed in Darknet markets and bought by other threat actors
- The infected devices may be used to attack internal networks months after the Axios supply chain
