Attackers gained control of the npm account for the Axios package, a widely used JavaScript HTTP client downloaded over 100 million times weekly, to distribute remote access trojans to Linux, Windows, and macOS computers.

Reports from cybersecurity firms Endor Labs, Socket, Aikido, and StepSecurity indicate that the attacker uploaded two infected versions of the package to the npm registry.

One harmful version, [email protected], was released at 00:21 UTC, followed by [email protected] less than an hour later, at 01:00 UTC.

The versions were published without the expected automated origin verification and lacked matching GitHub commits, which should have triggered an immediate warning.

Researchers believe the attacker gained access to the package by compromising the npm account of Jason Saayman, the primary Axios maintainer.

The extent of the impact on downstream projects from this supply-chain attack is currently unknown, as it was live for nearly three hours.

Given the Axios npm package’s extensive usage, with approximately 400 million downloads each month, the affected number could be significant.

Axios is used to simplify HTTP requests (GET, POST, PUT/PATCH, and DELETE) between client-side applications (like browsers or Node.js apps) and servers.

Once they gained access, the attacker added a malicious dependency, plain-crypto-js@^4.2.1, to the package.json file without altering the original Axios code.

This added dependency executes a script when the package installs, initiating an obfuscated dropper (setup.js) that connects to a control server to download a payload specific to the target operating system.

On Windows, the attack uses VBScript and PowerShell to hide a Command Prompt window and run a malicious script. It copies PowerShell to %PROGRAMDATA%\wt.exe to avoid detection and maintain persistence, then downloads and executes a PowerShell script.

On macOS, AppleScript is used to download a binary to /Library/Caches/com.apple.act.mond, mark it as executable, and run it in the background.

On Linux systems, the dropper downloads a Python payload from ‘/tmp/ld.py’ and executes it in the background using the nohup command.

In each scenario, a remote access trojan (RAT) is installed, granting attackers control and persistence on infected systems.

The RAT is capable of downloading and running base64-encoded binaries into a hidden temporary file, executing commands via /bin/sh or AppleScript, and listing directories.

After infection, the dropper deletes itself, removes the compromised package.json file, and replaces it with an uninfected copy to complicate analysis.

StepSecurity researchers suggest that the Axios attack was premeditated because the malicious dependency was added 18 hours beforehand.

The delivery of operating system-specific payloads and the self-deletion actions suggest this was a carefully planned attack.

The identity of the attacker behind the Axios supply-chain incident is currently unknown.

Recently, the TeamPCP group has claimed responsibility for a series of prominent supply-chain attacks, targeting open-source projects like Telnyx, LiteLLM, and Trivy.

However, this Axios compromise does not appear to be associated with TeamPCP, and researchers haven’t been able to attribute it to a specific threat actor.

Axios users are advised to use [email protected] and [email protected], the most recent known clean releases.

If a compromise is suspected, it is advised to change all credentials and rebuild environments from a trusted state.