Poisoned Axios Package Spreads Cross-Platform Malware via Phantom Dependency

Hackers hijacked the npm account of Axios’s lead maintainer. They used it to push two malicious releases that silently installed a cross‑platform remote access trojan (RAT) on macOS, Windows, and Linux systems.

Axios is one of the JavaScript ecosystem’s most widely used HTTP clients, with over 100 million weekly downloads on npm, making it deeply embedded across web applications, backends, and CI/CD pipelines.

These releases were never built or tagged via the official GitHub repository and exist only on npm, immediately signaling a deviation from Axios’s normal GitHub Actions–based release process.

Anyone who ran npm install with flexible version ranges covering these versions during the brief exposure window potentially executed the embedded malware in their development, CI/CD, or production environments.

According to the report, On March 30–31, 2026, an attacker abused this reach by publishing two poisoned versions axios 1.14.1 and 0.30.4 using stolen credentials for the maintainer’s npm account.

Poisoned Axios Package

The malicious Axios builds introduced a single new dependency, plain-crypto-js@^4.2.1, which does not appear in the Axios source code and is never imported at runtime, marking it as a classic “phantom dependency” added solely for its side effects during installation.

Version 4.2.0 of plain-crypto-js was first published as a benign decoy to build trust and package history, followed hours later by the weaponized 4.2.1 release that added a postinstall hook (node setup.js) acting as a cross‑platform RAT dropper.

Automated npm security scanners quickly flagged plain-crypto-js and then the malicious Axios versions within minutes of publication, prompting npm administrators to remove the compromised packages and revoke associated tokens within a few hours.

Despite the short dwell time, telemetry from multiple security vendors indicates that organizations in sectors including government, finance, healthcare, technology, and manufacturing were affected.

Legitimate Axios 1.x releases are normally published via GitHub Actions using npm’s OIDC Trusted Publisher, cryptographically tying the npm package to a verified CI workflow.

In contrast, axios 1.14.1 and 0.30.4 were pushed manually using a stolen npm access token tied to the maintainer account, with no trustedPublisher metadata and no gitHead, leaving no corresponding commit, tag, or release in the GitHub repo.

Once the compromise was detected, a project collaborator reported that the attacker, controlling an admin‑level account, was even able to delete or unpin disclosure issues on GitHub, making incident response and communication more difficult.

The malicious plain-crypto-js@4.2.1 package’s setup.js script is heavily obfuscated, storing all sensitive strings in an encoded array and decoding them at runtime using layered XOR and base64 transformations to evade static analysis.

At install time, the script dynamically requires core Node modules (fs, os, child_process), fingerprints the host platform, and builds an HTTP command‑and‑control URL pointing to sfrclak[.]com:8000 with a campaign ID parameter (6202033).

On macOS, it writes and executes an AppleScript that downloads a binary RAT to /Library/Caches/com.apple.act.mond and launches it in the background; on Windows, it chains VBScript and a renamed PowerShell binary (wt.exe) to execute a fileless PowerShell RAT; on Linux, it retrieves a Python RAT to /tmp/ld.py and runs it via nohup, orphaned to PID 1 to survive the npm process.

All three branches use HTTP POST traffic to the same C2 infrastructure, with request bodies that mimic npm‑related paths (for example, packages.npm.org/product0–2) to blend into logs and cursory reviews.

Anti‑forensics and phantom traces

Immediately after launching the RAT, setup.js deletes itself, deletes the malicious package.json containing the postinstall hook, and renames a clean stub manifest (package.md) back to package.json, effectively erasing obvious on‑disk traces inside node_modules/plain-crypto-js.

Because of this self‑destruction sequence, post‑incident filesystem inspection often shows only a benign‑looking plain-crypto-js package, making runtime telemetry, lockfile history, and network logs more reliable indicators of compromise.

Security researchers note that the simple presence of node_modules/plain-crypto-js in environments that resolved Axios during the affected window is a strong signal of compromise, since legitimate Axios versions never depend on this package.

Subsequent investigations linked the same plain-crypto-js–based dropper and sfrclak[.]com C2 infrastructure to other npm packages, including forks and bundled distributions that shipped malicious Axios builds pre‑embedded in their node_modules directory.

The campaign maps cleanly to multiple MITRE ATT&CK techniques, including software supply chain compromise, obfuscated scripts, masquerading, fileless PowerShell, and anti‑forensics cleanup, underscoring its sophistication and operational planning.

Defenders are urging organizations to pin Axios to safe versions (such as 1.14.0 or 0.30.3), purge any plain-crypto-js remnants, rebuild affected systems from known‑good images when artifacts are found, rotate all exposed secrets, and enforce npm ci –ignore-scripts with strict egress monitoring in CI/CD as a standing control against similar attacks.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.