Axios NPM Compromise File Creation Indicators - MacOS

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

2026-04-01 00:00:00

None

2db0458c-05c9-4069-a26f-77becd9c8c13

attack.initial-access attack.t1195.002 attack.command-and-control attack.t1105 detection.emerging-threats

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5928 from @swachchhanda000 - Add Axios NPM Compromise Indicators Related Rules

2026-04-01