Axios npm Supply Chain Attack Delivering Cross-Platform RAT

Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.

Executive Summary

On March 31, 2026, the widely used axios HTTP client was compromised via a stolen npm access token, leading to the publication of malicious versions 1.14.1 and 0.30.4. These versions introduced a new dependency, plain-crypto-js@4.2.1, which contained a postinstall hook that executed an obfuscated JavaScript dropper. The attack was highly efficient, lasting only 169 minutes before the packages were removed, but it impacted numerous CI/CD pipelines and developer environments during that window.

The infection chain is cross-platform, deploying a Mach-O binary on macOS, a PowerShell-based RAT on Windows, and a Python script on Linux. These payloads share a common C2 infrastructure and protocol, facilitating arbitrary command execution, system reconnaissance, and further binary injection. Notably, the attack bypassed standard GitHub OIDC publishing workflows, highlighting a critical reliance on long-lived npm tokens as a primary point of failure.

Key Details

Threat Name

Axios npm Supply Chain Attack

Affects

—

Adversary

—

MITRE Techniques

T1195.001 T1059.007 T1059.001 T1547.001 T1222 T1036.003 T1070.004 T1055.012 T1082 T1057 T1083 T1071.001 T1105 T1195.002 T1027 T1036 T1059.002 T1070 T1059.006

Malware/Tools

com.apple.act.mond, windows_rat.ps1, ld.py, setup.js, plain-crypto-js, Extension.SubRoutine, Mach-O RAT

Report Score

9out of 10

Quality Score

Excellent

IOC Quality9

TTP Details9

Detection Guidance7

Enterprise Relevance9

Clarity & Structure10

Technical Depth9