Axios NPM Compromise File Creation Indicators - Windows

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

2026-04-01 00:00:00

None

cd6386fa-bb9a-4b67-b006-786b6ab5d2ba

attack.initial-access attack.t1195.002 detection.emerging-threats

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5928 from @swachchhanda000 - Add Axios NPM Compromise Indicators Related Rules

2026-04-01