Axios npm compromise: XOR dropper to cross-platform RAT

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•103•3•1,552

This rule detects suspicious activity across process events, file events, and network events by looking for specific SHA1/SHA256 hashes, command line arguments, folder paths, and remote URLs. The indicators suggest potential malware execution, file manipulation, or command and control communication.