On March 30, 2026, a supply chain security attack targeted Axios, a widely used JavaScript HTTP client for web and Node.js applications. Third-party researchers identified that Axios versions 1.14.1 and 0.30.4 published to the npm registry were compromised following the apparent takeover of a legitimate maintainer account. An attacker published unauthorized package updates that appeared legitimate.
The affected releases introduced a malicious dependency that executes during installation and deploys a cross‑platform remote access trojan (RAT). The malware communicates with a command and control (C2) server to retrieve platform‑specific second‑stage payloads. After execution, the malware attempts to remove installation artifacts and replaces its own package metadata with a clean version to evade forensic detection.
Activity related to this threat was first detected in Sophos customer telemetry at approximately 00:45 UTC on March 31, with widespread impact by 01:00 UTC. MacOS, Windows, and Linux systems were impacted, but there is no evidence of threat actors conducting follow-on activity as of this publication.
Counter Threat Unit™ (CTU) analysis of the Axios npm compromise revealed artifacts linked to previous activity attributed to the NICKEL GLADSTONE threat group. This state-sponsored group focuses on generating revenue for the North Korean regime. The artifacts include identical forensic metadata and command and control (C2) patterns, as well as connections to malware exclusively used by NICKEL GLADSTONE. Based on these artifacts, it is highly likely that NICKEL GLADSTONE is responsible for the Axios attacks.
CTU™ researchers recommend that organizations review Axios packages in their environments and determine if potentially affected versions have been installed. Organizations should update vulnerable packages to trusted versions or apply appropriate mitigations. CTU researchers also advise reviewing system and application logs for unusual activity that may indicate compromise.
The following Sophos protections relate to this threat:
The threat indicators in Table 1 can be used to detect activity related to this threat. Note that IP addresses can be reallocated. The domains, URL, and IP address may contain malicious content, so consider the risks before opening them in a browser.
| Indicator | Type | Context |
| 21d2470cae072cf2d027d473d168158c | MD5 hash | Malicious Axios version (axios-1.14.1.tgz) |
| 2553649f2322049666871cea80a5d0d6adc700ca | SHA1 hash | Malicious Axios version (axios-1.14.1.tgz) |
| 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd | SHA256 hash | Malicious Axios version (axios-1.14.1.tgz) |
| d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 | SHA1 hash | Malicious Axios version (axios-0.30.4.tgz) |
| 59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f | SHA256 hash | Malicious Axios version (axios-0.30.4.tgz) |
| db7f4c82c732e8b107492cae419740ab | MD5 hash | Malicious Axios version (plain-crypto-js-4.2.1.tgz) |
| 07d889e2dadce6f3910dcbc253317d28ca61c766 | SHA1 hash | Malicious Axios version (plain-crypto-js-4.2.1.tgz) |
| 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668 | SHA256 hash | Malicious Axios version (plain-crypto-js-4.2.1.tgz) |
| 7658962ae060a222c0058cd4e979bfa1 | MD5 hash | Artifact from Axios attack (setup.js) |
| b0e0f12f1be57dc67fa375e860cedd19553c464d | SHA1 hash | Artifact from Axios attack (setup.js) |
| e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 | SHA256 hash | Artifact from Axios attack (setup.js) |
| 089e2872016f75a5223b5e02c184dfec | MD5 hash | Windows first-stage payload in Axios attacks (system.bat) |
| 978407431d75885228e0776913543992a9eb7cc4 | SHA1 hash | Windows first-stage payload in Axios attacks (system.bat) |
| f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd | SHA256 hash | Windows first-stage payload in Axios attacks (system.bat) |
| 04e3073b3cd5c5bfcde6f575ecf6e8c1 | MD5 hash | Windows second-stage payload in Axios attacks (6202033 PowerShell RAT) |
| a90c26e7cbb3440ac1cad75cf351cbedef7744a8 | SHA1 hash | Windows second-stage payload in Axios attacks (6202033 PowerShell RAT) |
| 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 | SHA256 hash | Windows second-stage payload in Axios attacks (6202033 PowerShell RAT) |
| 7a9ddef00f69477b96252ca234fcbeeb | MD5 hash | macOS payload in Axios attacks (com.apple.act.mond) |
| 13ab317c5dcab9af2d1bdb22118b9f09f8a4038e | SHA1 hash | macOS payload in Axios attacks (com.apple.act.mond) |
| 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a | SHA256 hash | macOS payload in Axios attacks (com.apple.act.mond) |
| 9663665850cdd8fe12e30a671e5c4e6f | MD5 hash | Linux payload in Axios attacks (ld.py) |
| 59faac136680104948e083b3b67a70af9bfa5d5e | SHA1 hash | Linux payload in Axios attacks (ld.py) |
| fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf | SHA256 hash | Linux payload in Axios attacks (ld.py) |
| 8c782b59a786f18520673e8d669e3b0a | MD5 hash | Windows malware persistence file in Axios attacks (system.bat) |
| ae39c4c550ad656622736134035f17ca7a66a742 | SHA1 hash | Windows malware persistence file in Axios attacks (system.bat) |
| e49c2732fb9861548208a78e72996b9c3c470b6b562576924bcc3a9fb75bf9ff | SHA256 hash | Windows malware persistence file in Axios attacks (system.bat) |
| sfrclak[.]com | Domain name | C2 server linked to Axios attacks |
| callnrwise[.]com | Domain name | Linked to Axios attackers |
| hxxp://sfrclak[.]com:8000/6202033 | URL | C2 server linked to Axios attacks |
| 142[.]11[.]206[.]73 | IP address | C2 server linked to Axios attacks |
| nrwise@proton[.]me | Email address | Linked to Axios attackers |
| ifstap@proton[.]me | Email address | Linked to Axios attackers |
| C:\ProgramData\wt.exe | File path | Windows malware location in Axios attacks |
| C:\ProgramData\system.bat | File path | Windows first-stage malware location in Axios attacks |
Table 1: Indicators for this threat
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。