Axios NPM Package Compromised to Distribute Cross-Platform RAT

Summary

On March 30, 2026, security researchers discovered that the widely-used NPM package Axios was compromised through an account takeover attack targeting a lead maintainer. Threat actors bypassed the project's GitHub Actions CI/CD pipeline by compromising the maintainer's NPM account and changing its associated email. The threat actor manually published two malicious versions via NPM CLI.

These poisoned releases inject a hidden dependency called [email protected], which executes a postinstall script functioning as a cross-platform Remote Access Trojan (RAT) dropper targeting macOS, Windows, and Linux systems.

During execution, the malware contacts command-and-control (C2) infrastructure at sfrclak[.]com to deliver platform-specific payloads, then deletes itself and replaces its package.json with a clean version to evade detection.

Recommendations

• Review package.json, package-lock.json, and yarn.lock files for [email protected], [email protected], or [email protected]. Remove any compromised packages, clear caches, and reinstall clean ones.
• Downgrade to [email protected] (for 1.x users) or [email protected] (for 0.x users) and update lockfiles.
• Search for connections to sfrclak[.]com or 142.11.206[.]73 from developer workstations and CI/CD systems.
• Use private registry proxies and Software Composition Analysis (SCA) tools to filter and monitor third-party packages.
• Restrict open-source package consumption on corporate devices and CI systems to enterprise-open source package managers. Use Zscaler Internet Access controls to block access to internet package managers from corporate devices. Use native controls and Zscaler Private App Connectors to block access to internet package managers from CI systems.
• Apply lockfiles strictly (e.g., package-lock.json, pnpm-lock.yaml) and use npm ci instead of npm install.
• Reduce dependency surface by auditing and removing unused packages.
• Apply least privilege principles using scoped, short-lived keys and tokens.
• Revoke NPM tokens, GitHub PATs, cloud keys, and CI/CD secrets.
• Enable phishing-resistant multifactor authentication (MFA) on NPM, GitHub, and cloud platforms.
• Flag abnormal NPM publishes, unexpected GitHub workflow additions, or secret scanner usage in CI.
• Treat impacted systems as compromised by isolating, scanning, or reimaging them.
• Update response playbooks for supply chain attacks and run practice drills.
• Restrict build environments to internal package managers or trusted mirrors, and limit internet access to reduce exfiltration risk.
• Reinforce the secure handling of tokens and secrets, and train teams on phishing awareness and supply chain security best practices.
• Enforce a release cooldown period to ensure users can’t check out newly released packages, stopping emerging supply chain attacks.

Affected packages and versions

The following packages are impacted by this compromise.

Table 1: Axios package versions impacted by the compromise.

How it works

All NPM packages include a package.json file that declares dependencies. In the compromised version of Axios, the threat actor added a dependency for a malicious package called plain-crypto-js, which included a postinstall script that ran a setup.js script via node.

When developers or CI pipelines run npm install [email protected], NPM resolves the dependency tree, downloads [email protected], and runs the postinstall script. Running node setup.js triggers the compromise sequence.

Attack chain

The figure below shows the attack chain.

Figure 1: Attack chain for the compromised Axios package.