Backdoor Mechanics Exploit Post-Install Scripts

Attackers hijacked the Axios NPM lead maintainer's account—despite 2FA and GitHub auth—using a long-lived NPM CLI access token (possibly via recovery codes) to publish v1.14.1 (tagged latest) and v0.30.4 (tagged legacy) on March 31. These versions added a phantom 'plain crypto-js' dependency, a tweaked crypto-js with a malicious post-install 'setup.js' script. This script runs automatically on every npm install or CI execution, detects the OS (Windows, macOS Intel/Apple Silicon, Linux), and fetches a tailored second-stage RAT payload from a remote server.

The RAT self-cleans: original setup.js deletes itself, removes the malicious package.json post-install entry, and restores a clean version to evade detection. Packages like DataDog, OpenClaw, and WordPress inherited the compromise, affecting Axios's 174,000 dependents and 101 million weekly installs.

RAT Behaviors Steal Dev Credentials and Enable Remote Control

Once deployed, the RAT scans sensitive directories—Documents, Desktop, config folders (plus OneDrive, AppData, all drive letters on Windows)—exfiltrates the file list to attackers for theft assessment, then beacons every 60 seconds with hostname, username, OS, timezone, hardware model, and all running processes. This reveals active software and user presence.

Attackers can remotely issue four commands: (1) browse any directory, (2) execute arbitrary shell commands/scripts, (3) drop/execute more malware, (4) kill the process for cleanup. Treat any infected system as fully compromised: rotate all secrets like .env files, NPM tokens, SSH keys immediately.

Detect Infection and Respond Swiftly

Search lockfiles (package-lock.json, yarn.lock) for axios@1.14.1, axios@0.30.4, or plain-crypto-js. Scan node_modules for these packages. Hunt RAT artifacts per platform-specific write-ups (linked in source). Axios versions were yanked after 3 hours, but prior installs persist—assume credential theft.

Prevent Future Supply Chain Attacks

Commit lockfiles to pin versions and use npm ci (not npm install) in CI/CD to enforce exact installs. Set minimum package age (e.g., 48 hours) to skip fresh malicious uploads. Run npm install --ignore-scripts to block post-installs, or switch to Bun which disables them by default except on explicitly trusted deps. These steps caught this attack early but highlight rising NPM threats.