# Axios NPM Distribution Compromised in Supply Chain Attack

Attacker compromised an axios npm maintainer account and published trojanized axios versions depending on plain-crypto-js, whose dropper installed platform-specific RATs beaconing to C2.

- Payout: Real-world hack
- Severity: critical
- Program: axios
- Credited: Wiz Research
- Disclosed: 2026-03-31
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/axios-npm-compromised-in-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-axios-npm-compromised-in-supply-chain-attack
- Tags: domain:oss impact:data-leak impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:nodejs technique:recon vuln:misconfiguration vuln:secrets-leak

**Target:** npm package distribution (axios, plain-crypto-js)
**Root cause:** Compromised npm maintainer account (jasonsaayman) was used to publish malicious axios versions 1.14.1 and 0.30.4 that added a dependency on the newly created trojanized package plain-crypto-js, whose install-time setup.js dropper fetched second-stage RAT payloads.
**Steps:**
1. Compromise npm account jasonsaayman (ifstap@proton.me)
2. Publish plain-crypto-js@4.2.1 (by nrwise@proton.me) containing setup.js dropper
3. Publish axios@1.14.1 (00:21 UTC) and axios@0.30.4 (01:00 UTC) adding plain-crypto-js dependency
4. On install, setup.js downloads platform payload from `hxxp://sfrclak.com:8000/6202033` and executes it
5. Dropper self-deletes and restores clean package.json
6. Stage 2 beacons to C2 every 60s, sends system inventory, awaits commands (shell exec, binary injection, file/process recon)
7. Windows: PowerShell stage2.ps1 sets Run key `MicrosoftUpdate` -> `%PROGRAMDATA%\system.bat` for persistence; macOS: Mach-O `com.apple.act.mond` self-signs injected payloads via codesign; Linux: `/tmp/ld.py` Python RAT
**Exploitation:** Install-time execution of setup.js on any host installing the malicious axios versions; downloads OS-specific RAT from sfrclak.com:8000, establishes persistence (registry Run key on Windows, /Library/Caches on macOS), beacons every 60s to C2 for commands including remote shell and binary injection, enabling credential and secret theft from build systems and developer machines.
**Escalation:** High-prevalence package (~80% of cloud/code environments, ~100M weekly downloads) gave broad exposure; RAT access to build pipelines could enable further upstream supply chain compromise.
**Insight:** Watch for newly created transitive dependencies appearing in a popular package's manifest alongside a version bump — a fresh low-reputation package added as a dependency is a strong supply-chain compromise signal; also monitor install-time scripts making outbound connections to non-registry hosts.