CP
cyberpings
Threat IntelHIGH

STARDUST CHOLLIMA - Compromises Axios npm Package

Featured image for STARDUST CHOLLIMA - Compromises Axios npm Package
CRCrowdStrike Blog
STARDUST CHOLLIMAAxiosZshBucketnpmsupply chain attack
🎯

Basically, hackers used stolen credentials to infect a popular software package.

Quick Summary

A serious security breach has compromised the Axios npm package, affecting countless developers. This incident highlights the vulnerabilities in software supply chains, especially for cryptocurrency users. Action is needed to safeguard against these sophisticated attacks.

What Happened

On March 31, 2026, a significant security incident unfolded as the threat actor known as STARDUST CHOLLIMA compromised the widely used Axios Node Package Manager (npm) package. This HTTP client library, which is downloaded over 100,000 times a week, was infiltrated using stolen maintainer credentials. The attackers deployed platform-specific variants of their malware, ZshBucket, marking a concerning escalation in their operations.

CrowdStrike's Counter Adversary Operations team attributed this activity to STARDUST CHOLLIMA with moderate confidence. This attribution is based on the deployment of updated ZshBucket variants, which have been uniquely associated with this threat actor. The malware not only targets Linux and macOS systems but also Windows, expanding its potential impact significantly compared to previous versions that focused solely on macOS.

Who's Being Targeted

The Axios npm package is a critical component for many developers and organizations, making this compromise particularly alarming. Given the high download rate, the number of potential victims could be vast. The primary targets of this attack appear to be cryptocurrency holders, as STARDUST CHOLLIMA has a history of prioritizing operations that generate currency through various means, including supply chain compromises.

The updated ZshBucket variants feature advanced capabilities, allowing operators to inject binary payloads, execute arbitrary scripts, and enumerate file systems. This sophistication indicates a strategic shift in the adversary's approach, aiming for more significant and impactful attacks.

Tactics & Techniques

The deployment of ZshBucket in this incident showcases several notable enhancements compared to earlier variants. For instance, the new instances utilize a common JSON-based messaging protocol across all platforms. This change improves the malware's efficiency and effectiveness in communicating with command-and-control (C2) servers.

Additionally, the malware retains characteristics from previous iterations, such as profiling the user and host operating system. However, the introduction of commands that allow for remote termination of the implant and execution of arbitrary commands marks a significant upgrade in functionality, making it a more formidable threat.

Defensive Measures

Organizations using the Axios npm package should take immediate action to mitigate risks associated with this compromise. Here are some recommended steps:

  • Audit Dependencies: Review all npm packages in use, especially those related to Axios, and check for any unauthorized modifications.
  • Implement Security Best Practices: Use tools that can monitor and alert on suspicious activity within your software supply chain.
  • Educate Developers: Ensure that development teams are aware of the risks associated with third-party libraries and the importance of maintaining secure coding practices.

As STARDUST CHOLLIMA's operational tempo continues to increase, vigilance is essential. The threat landscape is evolving, and organizations must adapt to protect their assets effectively.

🔒 Pro insight: The sophistication of the updated ZshBucket variants suggests STARDUST CHOLLIMA is enhancing its operational capabilities, warranting increased vigilance from developers.

Original article from

CRCrowdStrike Blog· Counter Adversary Operations
Read Full Article

Share

Related Pings

HIGHThreat Intel

Supply Chain Attack - Axios npm Package Compromised

A major supply chain attack targeted the Axios npm package, affecting millions of applications. Malicious versions were published, risking user data and system integrity. Organizations must act quickly to mitigate the impact and secure their environments.

Arctic Wolf Blog·
HIGHThreat Intel

Axios Supply Chain Attack - How It Was Detected

A major supply chain attack on Axios was detected using a proof of concept tool. This incident highlights vulnerabilities in package management systems and the need for better security measures. Swift action was taken to mitigate the damage and protect users.

Elastic Security Labs·
HIGHThreat Intel

Axios npm Supply Chain Attack - Mitigation Steps Explained

Axios experienced a serious supply chain attack linked to North Korea's Sapphire Sleet. Countless users who downloaded the malicious npm packages are at risk. Immediate actions are necessary to secure affected systems and prevent further exploitation.

Microsoft Security Blog·
HIGHThreat Intel

Iran Cyber Campaign - North Korea Targets Axios NPM Package

Iran's cyber campaign intensifies, targeting U.S. interests. North Korea compromises the Axios NPM package, raising serious supply chain concerns. Organizations must act swiftly to bolster defenses.

CyberWire Daily·
HIGHThreat Intel

Mercor Confirms Security Incident from LiteLLM Supply Chain Attack, Data Stolen

Mercor confirms it was impacted by the LiteLLM supply chain attack, with significant data theft reported by the extortion group Lapsus$.

The Record·
HIGHThreat Intel

Axios Supply Chain Attack - Widespread Impact Revealed

A recent supply chain attack on Axios has led to the deployment of malware across multiple sectors. This incident affects businesses globally, emphasizing the critical need for immediate security measures. Stay informed and protect your systems from potential exploitation.

Palo Alto Unit 42·