Axios NPM Compromise Indicators - Windows

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

2026-04-01 00:00:00

None

f6c27ecc-d890-4452-80e6-2e274a10e097

attack.initial-access attack.t1195.002 attack.execution attack.command-and-control attack.defense-evasion attack.t1059.003 attack.t1059.005 attack.t1105 detection.emerging-threats

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5928 from @swachchhanda000 - Add Axios NPM Compromise Indicators Related Rules

2026-04-01