Compromised Axios npm package version (1.14.1 and 0.30.4) C2 NGFW Traffic

Ali AlEnezi@site

•updated Apr 5, 2026•12•0•338

This rule detects network traffic to the command and control (C2) domain 'sfrclak.com', which is associated with compromised versions of the Axios npm package (specifically 1.14.1 and 0.30.4). This traffic represents the first stage of activity where dropper scripts on an affected endpoint attempt to communicate with their C2 server.