axios-supply-chain-attack-2026.md

Axios npm Supply Chain Attack — March 31, 2026

What Happened

A North Korea-linked threat actor (UNC1069) hijacked the npm account of an axios maintainer and published two backdoored versions. They were live for ~3 hours before npm removed them.

Timeline (UTC)

• 00:21 — Malicious [email protected] published (latest dist-tag)
• 00:39 — Malicious [email protected] published (legacy dist-tag)
• ~03:15 — npm removes compromised versions

How It Works

Both versions added a hidden dependency: [email protected] (typosquat of crypto-js). Its postinstall hook downloaded a cross-platform RAT from sfrclak[.]com:8000, then erased itself.

Platform-specific payloads:

• macOS: /Library/Caches/com.apple.act.mond
• Windows: %PROGRAMDATA%\wt.exe (PowerShell via VBScript)
• Linux: /tmp/ld.py

Am I Affected?

You're at risk if you ran npm install on any project between 00:21–03:15 UTC on March 31, 2026.

Check your lockfiles

grep -r "axios.*1\.14\.1\|axios.*0\.30\.4\|plain-crypto-js" \
  package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null

Check for filesystem IOCs

# macOS
ls -la /Library/Caches/com.apple.act.mond 2>/dev/null && echo "INFECTED" || echo "Clean"

# Linux
ls -la /tmp/ld.py 2>/dev/null && echo "INFECTED" || echo "Clean"

# Windows (PowerShell)
Test-Path "$env:PROGRAMDATA\wt.exe"

Check network connections

# Active C2 connections
lsof -i -n | grep -E "sfrclak|142\.11\.206\.73"

# DNS history (macOS)
log show --predicate 'process == "mDNSResponder"' --last 2d | grep sfrclak

Network IOCs

Indicator	Type
sfrclak[.]com	C2 domain
142.11.206.73:8000	C2 IP
User-Agent: mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)	HTTP signature

If You're Infected

1. Isolate the machine from the network immediately
2. Do NOT attempt in-place cleanup — re-image or restore from a backup before March 30
3. Rotate ALL credentials accessible from the machine: npm tokens, AWS keys, SSH keys, .env secrets, CI/CD tokens
4. Block sfrclak[.]com and 142.11.206.73 at DNS/firewall level

Prevention

• Use npm ci --ignore-scripts in CI/CD
• Pin exact versions (no ^ or ~ ranges)
• Use Socket.dev or Snyk for supply chain monitoring
• Enable npm audit signatures to verify package provenance

References

• Elastic Security Labs — Inside the Axios supply chain compromise
• The Hacker News — Axios Supply Chain Attack
• Google Cloud Blog — North Korea-Nexus Threat Actor
• Socket.dev — Axios npm package compromised
• SOCRadar — IOCs, Impact & Remediation
• Snyk — Axios Supply Chain Attack