Axios npm package compromised

mttaggart · March 31, 2026, 4:48am

This is a big deal. Already seeing evidence of this by way of OpenClaw installations.

mttaggart · March 31, 2026, 5:41am

GitHub issue on Axios for the disclosure:

mttaggart · March 31, 2026, 5:46am

Looks like OpenClaw’s installer installs the malware.

github.com/openclaw/openclaw

[Bug]: Running official install command triggers Windows Defender - malicious batch file and registry keys added

opened 05:00AM - 31 Mar 26 UTC

CodeHatchling

bug bug:behavior

### Bug type Behavior bug (incorrect output/state without crash) ### Beta rele…ase blocker No ### Summary When running the official installation command from https://openclaw.ai, malicious changes are made to your computer that Windows Defender complains about loudly. ### Steps to reproduce 1. Open link to https://openclaw.ai 2. Copy command shown into cmd.exe, press enter. 3. When asked to install Node.js, allow. 4. Some time later, Windows Defender catches the following threat: ```shell Detected: Trojan:Script/Wacatac.H!ml Status: Removed A threat or app was removed from this device. Date: 3/30/2026 8:34 PM Details: This program is dangerous and executes commands from an attacker. Affected items: file: C:\ProgramData\system.bat regkey: HKCU\S-1-5-21-2809631006-2546530116-4178093205-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\MicrosoftUpdate runkey: HKCU\S-1-5-21-2809631006-2546530116-4178093205-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\MicrosoftUpdate ``` ### Expected behavior It installs normally. ### Actual behavior After installing Node.js (?), these changes appear and are caught by WindowsDefender. - File: ```C:\ProgramData\system.bat``` - Registry: ```HKCU\S-1-5-21-2809631006-2546530116-4178093205-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\MicrosoftUpdate``` This behaviour appears to be malicious since most programs will not attempt to disguise themselves as 'system.bat' or 'MicrosoftUpdate'. ### OpenClaw version OpenClaw 2026.3.28 (f9b1079) ### Operating system Windows 11 ### Install method powershell -c "irm https://openclaw.ai/install.ps1 | iex" ### Model N/A ### Provider / routing chain N/A ### Additional provider/model setup details _No response_ ### Logs, screenshots, and evidence ```shell Detected: Trojan:Script/Wacatac.H!ml Status: Removed A threat or app was removed from this device. Date: 3/30/2026 8:34 PM Details: This program is dangerous and executes commands from an attacker. Affected items: file: C:\ProgramData\system.bat regkey: HKCU\S-1-5-21-2809631006-2546530116-4178093205-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\MicrosoftUpdate runkey: HKCU\S-1-5-21-2809631006-2546530116-4178093205-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\MicrosoftUpdate ``` ### Impact and severity One or more of the dependencies installed via the command provided may be compromised. ### Additional information - I did not accept the disclaimer after the first install. It seems to have automatically marked it as 'No'. - After running the command a second time, it appeared to bypass the disclaimer and automatically run a 'doctor' and finishing with a success message.

mttaggart · March 31, 2026, 5:31pm

Dropped payload analysis here:

gist.github.com

https://gist.github.com/N3mes1s/0c0fc7a0c23cdb5e1c8f66b208053ed6

00_README.md

# Axios npm Supply Chain Compromise — Full Analysis Package

**Date:** 2026-03-31 | **Attribution:** BlueNoroff / Lazarus Group (HIGH confidence)
**Attack:** Maintainer account hijacked, cross-platform RAT deployed via axios@1.14.1 and axios@0.30.4

## What happened

On March 30-31, 2026, the npm package axios (~83M weekly downloads) was compromised through a maintainer account hijack. Two malicious versions injected `plain-crypto-js@4.2.1`, an obfuscated dropper that deploys platform-specific RATs (Windows PowerShell, macOS Mach-O C++, Linux Python). The macOS RAT is classified as NukeSped (Lazarus-exclusive). The internal project name `macWebT` links directly to BlueNoroff's documented RustBucket `webT` module from 2023.

## File Index

This file has been truncated. show original

Axios_Supply_Chain_Report_VERIFIED.md

# Axios NPM Supply Chain Compromise — Verified Threat Intelligence Report

**Date:** 2026-03-31 | **Last Updated:** 2026-03-31 11:00 UTC
**Classification:** CRITICAL — Active Supply Chain Attack
**TLP:** CLEAR
**Analyst:** Automated Analysis (Claude Code) — Independent Verification Pass
**Status:** Incident contained (~3h exposure window), investigation ongoing

## Table of Contents

This file has been truncated. show original

Dropped_Payloads_Analysis.md

# Axios Supply Chain — Dropped Payloads Full Reverse Engineering

**Last Updated:** 2026-03-31 11:00 UTC
**Analysis Environment:** Lima VM (Ubuntu 24.04 ARM64, isolated, no network)
**Tools Used:** radare2, Node.js (deobfuscation), strings, file, xxd, python3
**Samples Source:** VirusTotal API download (vt-cli)
**All files renamed to `.mlwr` extension for safety

## Table of Contents

This file has been truncated. show original

There are more than three files. show original

neurovagrant · March 31, 2026, 6:08pm

So it’s probably unrelated, but worth noting that an hour before sfrclak[.]com was registered at namecheap, callnrwise[.]com was registered at dynadot.

callnrwise[.]com is completely different from the C2 domain of sfrclak[.]com, except for one thing: DNS resolving to the same C2 IP (142.11.206[.]73) as of about fifteen minutes before sfrclak began resolving to it.

iris-pe-export-2026-03-31T13_11_48-04_00.csv (10.3 KB)

DNSDB_RRSet__.callnrwise.com_ANY_Limit_5000_20260331_171050.csv (562 Bytes)

DNSDB_RRSet__.sfrclak.com_ANY_Limit_5000_20260331_162541.csv (1.5 KB)

DNSDB_RData_142.11.206.73_ip_Limit_5000_20260331_162503.csv (7.0 KB)

pDNS and domain records attached. other than that domain overlap, not super interesting.

mttaggart · March 31, 2026, 7:28pm

Google is claiming DPRK attribution:

mttaggart · April 1, 2026, 5:18am

Huntress has some more domains here:

calltan[.]com
callnrwise[.]com

mttaggart · April 1, 2026, 10:55pm

Details on the compromise of Axios. Basically, the attackers reached out to collab, sent malware via some means, and we’re off to the races.

unfortunately i feel vicitim to what seems to be a pretty well known (not to me) at the time social engineering attack. where a group masquerades as someone who is interested in working or partnering together on open soruce or similar. this lead to me getting compromised i think their access would have been complete irrespective of what was setup. i have since formatted all my devices and completely reset every account i own. i have also taken steps to improve my own security etiquette. i will also be much less trusting of anything i get in terms of enquiry around open source from here on out. i will also get a fido key as suggested and will continue to improve my overall security base.

[sic]

mttaggart · April 3, 2026, 5:39pm

Full postmortem here. Nothing new but a solid compilation of what, when, and how, along with what to look for.

github.com/axios/axios

Post Mortem: axios npm supply chain compromise

opened 03:06PM - 02 Apr 26 UTC

jasonsaayman

type::security

# Post Mortem: axios npm supply chain compromise **Date:** March 31, 2026 **Aut…hor:** Jason Saayman **Status:** Remediation in progress On March 31, 2026, two malicious versions of axios (1.14.1 and 0.30.4) were published to the npm registry through my compromised account. Both versions injected a dependency called `plain-crypto-js@4.2.1` that installed a remote access trojan on macOS, Windows, and Linux. The malicious versions were live for about 3 hours before being removed. ## Are you affected? Check your lockfile: ```bash grep -E "axios@(1\.14\.1|0\.30\.4)|plain-crypto-js" package-lock.json yarn.lock 2>/dev/null ``` If anything comes back, treat that machine as compromised: 1. Downgrade to `axios@1.14.0` (or `0.30.3` for 0.x users) 2. Delete `node_modules/plain-crypto-js/` 3. Rotate every secret, token, and credential on that machine 4. Check your network logs for connections to `sfrclak[.]com` or `142.11.206.73` on port 8000 5. If this happened on a CI runner, rotate any secrets that were injected during the affected build If you were already pinned to a clean version and didn't run a fresh install between 00:21 and 03:15 UTC on March 31, you're fine. For detailed remediation guidance, including CI/CD-specific steps, see: - [StepSecurity: full technical analysis and remediation](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan) - [Snyk: advisory and scanning guidance](https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/) - [Socket: Supply Chain Attack on Axios Pulls Malicious Dependency from npm](https://socket.dev/blog/axios-npm-package-compromised) ## What happened The attacker gained access to the lead maintainer's PC through a targeted social engineering campaign and RAT malware. This gave them access to the npm account credentials, which they used to publish the malicious versions. The attack followed patterns documented in similar campaigns targeting open source maintainers. ## Resolution Complete wipe of all lead maintainer devices as well as resetting of all credentials. This includes all accounts irrespective of platform, both personal and all other capacities. ## What's changing To prevent this from happening again, these are the changes being made: | Action | Type | | --- | --- | | Reset of all devices and credentials | Prevention | | Immutable release setup | Prevention | | Proper adoption of OIDC flow for publishing | Prevention | | Improvement of overall security posture | Prevention | | Updating of all GitHub actions to adopt best practices | Prevention | This list is not the end. We will continue actively working on improving security beyond these items. ## Attack Timeline I don't have an exact timeline for when the initial compromise occurred, but this is the sequence of events for the package itself: - About 2 weeks before March 31: social engineering campaign initiated against the lead maintainer - March 30, 05:57 UTC: `plain-crypto-js@4.2.0` published to npm - March 31, 00:21 UTC: `axios@1.14.1` published with `plain-crypto-js@4.2.1` injected - March 31, around 01:00 UTC: `axios@0.30.4` published with the same payload - March 31, around 01:00 UTC: first external detections - March 31, around 01:00 UTC: community members file issues reporting the compromise. The attacker deletes them using the compromised account. - March 31, 01:38 UTC: axios collaborator DigitalBrainJS opens PR #10591 to deprecate the compromised versions, flags the deleted issues to the community, and contacts npm directly - March 31, 03:15 UTC: malicious versions removed from npm - March 31, 03:29 UTC: `plain-crypto-js` removed from npm For detailed technical timelines: - [StepSecurity: forensic timeline](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan) - [Datadog Security Labs: full attack flow and response analysis](https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/) ## Lessons learned We are actively investigating how unauthorized access was obtained and reviewing all aspects of our security posture and access controls. While we do not have confirmed details to share at this time, this incident reinforces the need for continuous monitoring, strong account protections, and vigilance across both project infrastructure and individual maintainer environments. We will continue to strengthen our practices in alignment with industry best practices and in collaboration with groups such as the OpenJS Security Working Group. Security posture should be continuously monitored and improved. Specifically from this incident: - Publishing directly from a personal account was a risk that could have been avoided. The OIDC flow and immutable release setup we are now adopting should have been in place before this happened. - There was no automated way to detect an unauthorized publish. Detection depended entirely on the community noticing. - Open source maintainers with high-impact packages are active targets for sophisticated social engineering. Hyper vigilance is needed both on the registry and in a personal capacity. ## Summary for broarder audience We can confirm that two compromised versions of Axios were briefly made available through a widely used software download system due to unauthorized access to the lead maintainer's account, not a change to the underlying code. We are working with the companies that operate this system, along with security experts, to investigate and contain the issue. Organizations that installed these versions should remove them immediately and treat affected systems as potentially compromised, including rotating any sensitive credentials. This was the result of a compromised lead maintainer's account, and we are actively investigating how access was obtained. We do not have confirmed details to share at this time. ## Acknowledgments Thanks to @DigitalBrainJS for acting fast when the compromised account had higher permissions than his own and for getting npm to take action. Thanks to Open Source Community and the npm security team for their fast response. The malicious versions have been removed from npm and are no longer infecting users. The immediate incident is resolved. We are actively working on the security improvements listed above to prevent this from happening again. I'll update this as the investigation progresses. Questions welcome in this thread.

rye · April 8, 2026, 6:02am

I think that there’s some potential discussion points that I take away from the event.

All systems leave patterns, the easiest path here for the attackers were human access paired with implicit trust. It is likely that there was some considerations that this part of the trust model ‘maintainer account’ would be easier to manipulate with an account take over, given that some best practices were not part of the maintainers security posture.

There are three failure modes that I observe.

Identity

There was issue with the ‘Identity’ with personal account publishing.

Process

A gap in process, no enforced CI. Code could be published directly, without safeguards like reviews.

Detection

A gap in detection mechanism

There was no first-class detection mechanism for unauthorized publishes—visibility relied on community input.

Safeguards

A lack of missing functions, in postmortem are present with assumed 20/20 hindsight applied.

OIDC provides key-less signing,
Key-less signing associates identities, rather than keys, with an artifact signature.

Immutable releases - preventing the ability to change a published version.

And provenance - verifying the build origin, provenance cannot prove that code is malicious or not, it provides a verifiable link, to the source code and build instructions.

We, culturally need to examine threat modeling that helps maintainers understand more about the landscape, and their tool set.

Along with a deeper understanding about social engineering, techniques and tactics.

What I ‘think’:

In the concepts of MUST

enforce short lived credentials
require hardware MFA
use least privilege roles
alert on publish outside of CI
enforce immutable releases
require code review before release
traceable builds
sign artifacts

In the concepts of SHOULD

have a clear rollback plan

What are some considerations and what is the easiest way to improve the tool chains people use, and how to keep them safe?

cR0w · May 18, 2026, 1:14pm

The OpenSourceMalware team has uncovered a disturbing connection between three seemingly unrelated NPM packages and the high-profile Axios package compromise that shook the JavaScript ecosystem in March 2026. While the security community focused on the immediate Axios incident response, the same threat actor was quietly deploying secondary infrastructure that has been harvesting developer credentials for nearly two months.

These packages represent a sophisticated follow-up campaign, using the same cryptographic keys as the original Axios attack but employing different command & control infrastructure to evade detection efforts focused on the known Axios IOCs.