Axios npm Supply Chain Compromise Delivers Cross-Platform RAT

Du'aine Davis

Observed in the wild

• In late March, malicious versions of the popular JavaScript HTTP library Axios, axios@1.14.1 and axios@0.30.4, were published to npm outside the project’s normal release workflow. Any organisation or developer automatically pulling these versions via version ranges was potentially exposed, affecting frontend, backend and enterprise JavaScript environments using Axios globally.
• Attackers abused a compromised npm publishing process to add a malicious dependency, plain-crypto-js@4.2.1, which executed via a postinstall script. The payload deployed an obfuscated, multi-stage, cross-platform RAT using Node.js, PowerShell, AppleScript or Python, with C2 over HTTP. The activity indicates a targeted software supply chain attack rather than developer error.
• Organisations are advised to identify and remove affected Axios and dependency versions immediately, review lockfiles and rebuild from known-good sources. With Microsoft Defender, monitor for unusual postinstall execution, renamed PowerShell binaries, suspicious script launches, and outbound HTTP beacons to unknown infrastructure. Strengthen dependency controls, token hygiene and publishing permissions to reduce supply chain risk.

Supply Chain Attack on Axios Pulls Malicious Dependency from...axios Compromised on npm - Malicious Versions Drop Remote Access Trojan - StepSecurity

Du'aine Davis

Mastra npm supply chain compromise attributed to Sapphire Sleet

Observed in the wild

• On 17 June, Microsoft reported a large-scale npm supply chain compromise affecting 140+ packages across the mastra and @mastra scopes . Developers and CI/CD environments that ran npm install or npm update after the poisoned versions were published were potentially exposed, even if the packages were not imported into application code.
• Microsoft assesses with high confidence that Sapphire Sleet, a North Korean state actor, compromised the ehindero npm maintainer account and injected easy-day-js, a malicious typosquat of dayjs. Its postinstall hook executed an obfuscated Node.js dropper, disabled TLS verification, contacted C2 infrastructure, deployed a second-stage payload, and enabled persistence, exfiltration, and follow-on PowerShell backdoor activity.
• Organisations are advised to review dependency trees and lockfiles for affected Mastra versions and easy-day-js, pin known-good versions, run installs with --ignore-scripts, rotate exposed credentials and tokens, and block listed C2 infrastructure. In Microsoft Defender XDR, hunt for node.exe executing setup.cjs or easy-day-js, outbound connections to 23.254.164.92 or 23.254.164.123, suspicious Node.js behaviour, reflective code loading, and anomalous Run key persistence.

From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet | Microsoft Security Blog