Hijacked axios maintainer account used to push remote access trojan to npm
Attackers published two malicious versions of axios, one of the most widely used JavaScript libraries, to the npm registry early on March 31 after taking over a maintainer's account. The releases, axios 1.14.1 and 0.30.4, pulled in a hidden dependency that installed a remote access trojan on developer machines and build servers.
Axios is used to make web requests in a huge share of JavaScript projects. Datadog Security Labs put its weekly downloads above 100 million, with about 174,000 dependent npm packages, so any project that installed or updated dependencies during the window could have run the malware.
What happened
According to Datadog, version 1.14.1 went live at 00:21 UTC and was tagged as the latest release, and 0.30.4 followed at 01:00 UTC. Both were gone by about 03:25 UTC. They added a dependency called plain-crypto-js version 4.2.1, a typosquat of the legitimate crypto-js library. Its install script downloaded and launched a second-stage RAT for Windows, macOS or Linux, then deleted traces of itself.
Datadog reported that the attacker social-engineered the maintainer by impersonating a company founder, using a fake Slack workspace and a Microsoft Teams call to get the maintainer to install a fake "update" that was actually malware. That handed over the npm credentials. The maintainer had two-factor authentication turned on and suspects a recovery code was used. The malicious versions were published directly from the account, bypassing the project's normal trusted-publishing pipeline.
Who is behind it
Attribution is unsettled. SANS noted early analysis suggesting a possible link to the TeamPCP campaign that hit several open-source projects in the preceding weeks, but called that unconfirmed. Datadog assessed the techniques did not match TeamPCP and said the social-engineering approach resembles a pattern Google has documented for a group it tracks as UNC1069, without linking the attack to that group.
What to do
- Search lockfiles and node_modules for axios 1.14.1 or 0.30.4 and plain-crypto-js 4.2.1. Run npm why axios to find transitive copies.
- Pin to a clean release such as 1.14.0 or 0.30.3 and reinstall.
- If an affected version was installed, treat the machine or CI runner as compromised and rotate npm tokens, cloud keys, SSH keys, database passwords and API tokens.
- Block the command-and-control domain sfrclak[.]com and IP 142.11.206.73 named by researchers.
- Consider a release-age cooldown in npm, pnpm or Yarn so brand-new versions are not installed automatically.
