CP
cyberpings
Malware & RansomwareHIGH

Axios npm Package Compromised - Malware Deployed via Update

SOSophos News
Axiosnpmmalware
🎯

Basically, hackers took over a popular package to spread malware.

Quick Summary

A recent attack compromised Axios npm packages, allowing malware deployment. Users on macOS, Windows, and Linux are at risk. Immediate updates to trusted versions are crucial to ensure security.

What Happened

On March 30, 2026, a significant supply chain security attack targeted the Axios npm package, a widely used JavaScript HTTP client. This attack was initiated after the apparent takeover of a legitimate maintainer account. Unauthorized updates were published for Axios versions 1.14.1 and 0.30.4 on the npm registry, introducing a malicious dependency that executes during installation. This malicious code deploys a cross-platform remote access trojan (RAT) that communicates with a command and control (C2) server.

The malware is designed to retrieve platform-specific second-stage payloads after execution. It also attempts to erase installation artifacts and replace its own package metadata with a clean version, making it harder for forensic teams to detect the compromise. This stealthy behavior raises significant concerns for developers and organizations relying on the Axios package for their applications.

Who's Being Targeted

The attack has a broad impact, affecting systems running macOS, Windows, and Linux. Early detection by Sophos customer telemetry indicated that the malicious activity began around 00:45 UTC on March 31, with widespread effects observed shortly after. Although the malware has been deployed, there is currently no evidence of follow-on activity from the threat actors, which may suggest a controlled operation.

Organizations using Axios are particularly at risk, especially those that have not updated their packages recently. The ease of installation and integration of npm packages makes this an attractive vector for attackers, highlighting the importance of supply chain security in software development.

Signs of Infection

Organizations should be vigilant for signs of infection related to the compromised Axios packages. Indicators of compromise include unusual activity in system and application logs, especially around the installation of Axios versions 1.14.1 and 0.30.4. The malware's behavior includes establishing communication with a C2 server and executing unauthorized commands on infected systems.

Sophos has identified several threat indicators related to this attack, including specific hashes for the malicious Axios versions and the payloads deployed. Users should be cautious about any unexpected changes in their environments, particularly if they have recently installed or updated Axios packages.

How to Protect Yourself

To mitigate the risks associated with this attack, organizations should take immediate action. First, review all Axios packages in your environments to determine if compromised versions are installed. If so, update to trusted versions or apply necessary mitigations to secure your systems.

Additionally, it is crucial to monitor system and application logs for any unusual activity that may indicate a compromise. Implementing robust security measures, such as endpoint protection and regular audits of third-party packages, can help safeguard against similar supply chain attacks in the future. As the threat landscape evolves, staying informed and proactive is key to maintaining security.

🔒 Pro insight: This incident underscores the vulnerabilities in supply chain security; expect heightened scrutiny on npm packages going forward.

Original article from

SOSophos News
Read Full Article

Share

Related Pings

HIGHMalware & Ransomware

CrystalX RAT - New Malware Blends Spyware and Prankware

Kaspersky has uncovered CrystalX RAT, a new malware-as-a-service that combines spyware and prankware features. This unique malware poses serious risks to users by stealing sensitive information and disrupting their systems. Stay informed and protect yourself against this evolving threat.

Kaspersky Securelist·
HIGHMalware & Ransomware

Malware Detectors Stumble When Evaluated on Different Datasets

A new study reveals that malware detection models often fail when faced with different types of malware. This gap in effectiveness poses risks for organizations relying on these models. Understanding this issue is crucial for improving endpoint security and adapting to evolving threats.

Help Net Security·
HIGHMalware & Ransomware

Phantom Stealer - New Infostealer and RAT Toolkit Unveiled

Phantom Stealer is a new malware toolkit targeting European industries. It steals sensitive data through phishing campaigns, posing serious risks to organizations. Cybersecurity experts are warning about its potential for identity theft and further attacks.

Infosecurity Magazine·
HIGHMalware & Ransomware

CrySome RAT - Advanced Malware Threatens Windows Systems

A new remote access trojan, CrySome, threatens Windows systems with advanced capabilities. It disables antivirus software and maintains persistence, putting users at risk. Vigilance is essential to combat this sophisticated malware.

SC Media·
HIGHMalware & Ransomware

AI Powers DeepLoad Credential-Stealing Campaign

A new AI-driven malware campaign, DeepLoad, is targeting enterprise IT environments for credential theft. It uses advanced techniques to evade detection, posing a significant risk to organizations. Security experts recommend enhancing training and detection strategies to combat this threat.

SC Media·
HIGHMalware & Ransomware

WhatsApp Malware Warning - Microsoft Urges Caution

Microsoft warns users to be cautious of a new WhatsApp malware campaign. Attackers exploit social engineering tactics to deliver malicious files. Protect your data by staying alert and educated.

The Register Security·