Full Report
An NPM supply chain attack struck the ubiquitous open-source axios library and Huntress has observed over a hundred affected devices.
Analysis Summary
# Incident Report: Supply Chain Compromise of axios npm Package
## Executive Summary
On March 31, 2026, the widely-used JavaScript library **axios** (100M+ weekly downloads) was targeted in a supply chain attack via a compromised maintainer account. The attacker published backdoored versions (1.14.1 and 0.30.4) that delivered a cross-platform Remote Access Trojan (RAT) to Windows, macOS, and Linux systems. The attack has been attributed to North Korean state-sponsored threat actors (UNC1069 / BlueNoroff).
## Incident Details
- **Discovery Date:** March 31, 2026
- **Incident Date:** March 31, 2026
- **Affected Organization:** Users of the `axios` npm package
- **Sector:** Global Technology / Software Development
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** March 31, 2026
- **Vector:** Credential Compromise
- **Details:** The attacker gained access to the npm credentials of the lead maintainer (`jasonsaayman`) and manually published two malicious releases.
### Lateral Movement
- **Details:** The malware functioned as a Remote Access Trojan (RAT), allowing attackers to move from the initial development environment to broader network infrastructure. The macOS version utilized the `macWebT` module, linked to BlueNoroff’s RustBucket campaigns.
### Data Exfiltration/Impact
- **Details:** The RAT was capable of credential theft and data exfiltration. Huntress observed over a hundred affected devices during the exposure window.
### Detection & Response
- **Discovery:** Huntress SOC and other security researchers (Elastic, Google) identified anomalous `postinstall` hooks and malicious dependencies.
- **Response actions:** Malicious packages were removed from the npm registry; C2 infrastructure was taken offline. Security teams issued advisories to rotate credentials and rebuild affected systems.
## Attack Methodology
- **Initial Access:** Supply Chain Attack (Compromised npm account).
- **Persistence:** Utilization of a `system.bat` script with a user-run registry key (observed on Windows systems).
- **Privilege Escalation:** Details not specified, but the RAT provided full control over the host environment.
- **Defense Evasion:** Use of a "phantom dependency" (`[email protected]`) to hide malicious code in a package that appeared legitimate but was never actually imported by axios code.
- **Credential Access:** The RAT targeted browser data and Keychain passwords (on macOS).
- **Discovery:** Automated `postinstall` scripts to identify the host operating system.
- **Lateral Movement:** C2-directed movement via established RAT backdoors.
- **Collection:** Automated gathering of system information and user credentials.
- **Exfiltration:** Data sent to C2 domains including `callnrwise[.]com` and `calltan[.]com`.
- **Impact:** System compromise, credential exposure, and potential long-term unauthorized access.
## Impact Assessment
- **Financial:** High (costs associated with incident response, forensic auditing, and system rebuilding).
- **Data Breach:** High (potential theft of development secrets, SSH keys, and environment variables).
- **Operational:** Significant disruption as organizations were forced to audit all CI/CD pipelines and developer workstations.
- **Reputational:** High for the npm ecosystem; underscores ongoing risks in open-source dependencies.
## Indicators of Compromise
- **Network Indicators:**
- `callnrwise[.]com`
- `calltan[.]com`
- **File Indicators:**
- `[email protected]` (Malicious npm package)
- `[email protected]` (Malicious npm package)
- `[email protected]` (Malicious dependency)
- `system.bat`
- **Behavioral Indicators:**
- Unexpected network traffic from `node_modules` during installation.
- New registry run keys pointing to batch files in temporary directories.
## Response Actions
- **Containment:** Immediate removal of malicious packages from the npm registry.
- **Eradication:** Identification and isolation of systems that downloaded the affected versions during the exposure window.
- **Recovery:** Full rebuild of compromised developer machines and rotation of all secrets (API keys, passwords, certificates) stored on those devices.
## Lessons Learned
- **Key Takeaways:** Even high-profile, ubiquitous packages are vulnerable to single-point-of-failure credential compromises.
- **Improvements:** The use of Multi-Factor Authentication (MFA) for npm publishing and automated scanning for new, unverified dependencies in established packages could have mitigated the speed of the attack.
## Recommendations
- **Audit:** Search for `[email protected]` and `[email protected]` in all `package-lock.json` or `yarn.lock` files.
- **Pinning:** Use strict version pinning and utilize tools like `npm audit` or Socket to monitor for supply chain anomalies.
- **Zero Trust:** Treat developer workstations as high-risk environments and implement strict egress filtering to prevent C2 communication.