• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Axios npm Supply Chain Compromise - macOS Payload and Package Execution

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Danny Y@zendannyy
    •updated Mar 31, 2026•14•0•317

    Detects the installation or execution of compromised npm packages related to the Axios supply chain attack, with execution or reference to the dropped macOS RAT payload.

    Sigma

    Tags

    T1059.004 - Unix ShellT1071 - Application Layer ProtocolTA0002 - ExecutionTA0011 - Command and ControlProcess CreationmacOSmacOS Endpoint Security Frameworkattack.command_and_controlattack.t1071attack.executionattack.t1059.004attack.t1195.002

    Found in

    • Axios npm Supply Chain Attack Delivering Cross-Platform RATLast updated Apr 6, 2026
    • Axios npm Supply Chain Attack Delivering Cross-Platform RATLast updated Apr 1, 2026

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?