Compromised Axios npm Releases Installed Cross-Platform RAT

Attackers hijacked an Axios maintainer's npm account and published malicious package versions axios@1.14.1 and axios@0.30.4, turning one of npm's most widely used JavaScript libraries into a supply-chain malware delivery channel. The poisoned releases, tracked as MAL-2026-2306 and GHSA-2x9r-6wxq-hrr7, reportedly introduced a hidden dependency, plain-crypto-js@4.2.1, whose postinstall behavior fetched a cross-platform remote access trojan for macOS, Windows, and Linux. The attacker is reported to have used a long-lived classic npm token, changed the maintainer account email, and bypassed the project's normal trusted publishing workflow by releasing directly through the npm CLI.

The malicious packages were available for roughly three hours before removal, but defenders were urged to treat any host or CI runner that installed them as fully compromised. Reported indicators included outbound connections to sfrclak[.]com:8000 and artifacts such as /Library/Caches/com.apple.act.mond on macOS, %PROGRAMDATA%\wt.exe on Windows, and /tmp/ld.py on Linux, with associated infrastructure including 142.11.206.73. Security guidance called for downgrading to axios@1.14.0 or 0.30.3, blocking the command-and-control domain, rebuilding affected systems from known-good images, rotating exposed credentials, and adopting controls such as delayed installation of newly published npm packages and disabling install scripts in CI/CD where feasible.