Axios NPM Compromise Indicators - Windows

experimentalhigh
Log-Quelle: windows · process_creationAutor Swachchhanda Shrawan Poudel (Nextron Systems)Datum 2026-04-01
01

Beschreibung

Was dies ist, in Kürze.

Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

02

Tags

attack.initial-accessattack.t1195.002attack.executionattack.command-and-controlattack.t1059.003attack.t1059.005attack.t1105detection.emerging-threats
03

Regelquelle (YAML)

title: Axios NPM Compromise Indicators - Windows
id: f6c27ecc-d890-4452-80e6-2e274a10e097
status: experimental
description: |
    Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise.
    On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
    The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
    The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.
references:
    - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
    - https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html?m=1
    - https://www.derp.ca/research/axios-npm-supply-chain-rat/
    - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
    - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-01
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.command-and-control
    - attack.t1059.003
    - attack.t1059.005
    - attack.t1105
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_cscript:
        ParentImage|endswith:
            - '\node.exe'
            - '\bun.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'cscript'
            - 'AppData\Local\Temp'
            - '//nologo && del'
            - '6202033.vbs'
    selection_curl:
        Image|endswith:
            - '\curl.exe'
            - '\powershell.exe'
        CommandLine|contains: 'http://sfrclak.com'
    selection_susp_cli:
        OriginalFileName: 'PowerShell.EXE'
        CommandLine|contains: '"C:\ProgramData\wt.exe" -w hidden -ep bypass -file'
    condition: 1 of selection_*
falsepositives:
    - Highly unlikely
level: high
04

erkennt Techniken (4)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.