Compromised Axios npm Releases Delivered Cross-Platform RAT via Malicious Dependency

Attackers hijacked the npm account of Axios maintainer Jason Saayman and published malicious axios@1.14.1 and axios@0.30.4, bypassing the project’s normal GitHub Actions OIDC publishing flow and adding the staged dependency plain-crypto-js@4.2.1. That package’s postinstall logic fetched platform-specific payloads from sfrclak[.]com:8000, deploying a remote access trojan on Windows, macOS, and Linux while deleting installer artifacts and restoring benign-looking package metadata to hinder detection. The poisoned releases were available for roughly three hours before removal, but Axios’s massive downstream use meant developer workstations, CI/CD pipelines, ephemeral builds, and transitive dependencies could all have resolved the malicious versions during the exposure window.

Researchers and vendors including Socket, StepSecurity, Elastic, Huntress, Microsoft, Google Threat Intelligence Group, and others said affected systems should be treated as fully compromised because the malware enabled reconnaissance, command execution, persistence on Windows, payload retrieval, and likely credential theft. Multiple reports tied the operation to a North Korea-linked actor—most prominently UNC1069, with other vendors using names such as Sapphire Sleet and STARDUST CHOLLIMA—while Axios later confirmed the maintainer had been compromised through a targeted social-engineering campaign involving fake corporate outreach and a bogus meeting workflow. Organizations were urged to roll back to safe versions such as 1.14.0 or 0.30.3, remove plain-crypto-js, rebuild impacted hosts, rotate all accessible secrets, review lockfiles and CI logs, and block traffic to the identified command-and-control infrastructure.