# Inside the Axios supply chain compromise - one RAT to rule them all

Compromised axios maintainer account published backdoored 1.14.1/0.30.4 whose plain-crypto-js postinstall dropped a cross-platform RAT on macOS, Windows and Linux.

- Payout: Real-world hack
- Severity: critical
- Program: axios
- Analysis by: Ruben Groenewoud, Samir Bousseaden, Salim Bitam, Joe Desimone, Colson Wilhoit, Andrew Pease
- Disclosed: 2026-04-01
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/axios-one-rat-to-rule-them-all
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-axios-one-rat-to-rule-them-all
- Tags: area:cloud domain:infra domain:oss impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:nodejs technique:source-review

**Target:** npm package postinstall hook and platform-native stage-2 implants (PowerShell, C++, Python)
**Root cause:** Attacker took over maintainer npm account jasonsaayman and published axios 1.14.1/0.30.4 (both dist-tags) adding dependency plain-crypto-js@4.2.1, whose postinstall runs setup.js automatically during npm install.
**Steps:**
1. Compromise maintainer account; publish clean decoy plain-crypto-js@4.2.0 then malicious 4.2.1 with `"postinstall": "node setup.js"`
2. Publish axios@1.14.1 (latest) and 0.30.4 (legacy) via direct CLI publish from ifstap@proton[.]me, no SLSA provenance
3. setup.js decodes string table (reverse+Base64, then XOR key `OrDeR_7077` index `7 * i² % 10`)
4. POST to `http://sfrclak[.]com:8000/6202033` with body `packages.npm.org/product0` (macOS), `product1` (Windows), `product2` (Linux)
5. macOS: osascript+curl drops `/Library/Caches/com.apple.act.mond`; Windows: VBScript+curl runs `%TEMP%\6202033.ps1` via renamed `%PROGRAMDATA%\wt.exe`; Linux: curl to `/tmp/ld.py` then python3
6. Implant beacons every 60s, Base64 JSON over HTTP POST with UA `mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)`, handles kill/peinject/runscript/rundir
7. Dropper self-deletes via `fs.unlink(__filename)` and renames clean `package.md` over `package.json`
**How found:** Automated supply-chain monitoring flagged the compromise on 2026-03-30; registry metadata showed maintainer email change and loss of OIDC/SLSA provenance on new versions.
**Exploitation:** Any `npm install axios` resolving to the tagged versions auto-executed the postinstall, which fetched and ran a platform-specific RAT giving the operator script execution, binary injection, directory browsing and (Windows) registry Run-key persistence.
**Escalation:** Tagged both latest and legacy dist-tags to maximize installs; Windows variant adds registry Run key + hidden .bat persistence surviving kill.
**Insight:** Diff npm publish metadata: a version published by direct CLI with a changed maintainer email and no provenance attestation, plus a brand-new single dependency with a postinstall hook, is the highest-signal supply-chain indicator.

## Proof of concept (copied exactly from the original report)

**Malicious postinstall hook in plain-crypto-js**

```
"scripts": {
 "postinstall": "node setup.js"
}

This causes setup.js to execute automatically during npm install — no user interaction required.
```