An attacker compromised the npm account of a lead Axios maintainer on March 30 and used it to publish two malicious versions of the widely used JavaScript HTTP client library, according to StepSecurity. The poisoned releases, [email protected] and [email protected], injected a hidden dependency that silently installed a cross-platform remote access trojan on developer machines running macOS, Windows, and Linux. Axios is downloaded roughly 100 million times per week on npm.
Both malicious versions added a single new dependency to the package manifest: [email protected], a purpose-built trojan disguised as the legitimate crypto-js library. The package was never imported or referenced anywhere in Axios source code. Its only function was to execute a postinstall script that contacted a command-and-control server at sfrclak.com, downloaded a platform-specific RAT payload, and then destroyed all evidence of its own execution.
