Axios NPM Compromise Indicators - Linux

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

2026-04-01 00:00:00

None

0a23a62d-c5b3-468b-a072-25064a9a8c87

attack.initial-access attack.t1195.002 attack.execution attack.command-and-control attack.defense-evasion attack.t1059.006 attack.t1059.004 attack.t1105 detection.emerging-threats

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5928 from @swachchhanda000 - Add Axios NPM Compromise Indicators Related Rules

2026-04-01