Detection rules › Sigma
Axios NPM Compromise Indicators - Linux
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1195.002 Supply Chain Compromise: Compromise Software Supply Chain |
| Execution | T1059.004 Command and Scripting Interpreter: Unix Shell, T1059.006 Command and Scripting Interpreter: Python |
| Command & Control | T1105 Ingress Tool Transfer |
Event coverage
| Provider | Event |
|---|---|
| Sysmon-for-Linux | Event ID 1 |
Rule body yaml
title: Axios NPM Compromise Indicators - Linux
id: 0a23a62d-c5b3-468b-a072-25064a9a8c87
status: experimental
description: |
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
references:
- https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- https://www.derp.ca/research/axios-npm-supply-chain-rat/
- https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
- https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
- https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-01
tags:
- attack.initial-access
- attack.t1195.002
- attack.execution
- attack.command-and-control
- attack.t1059.006
- attack.t1059.004
- attack.t1105
- detection.emerging-threats
logsource:
category: process_creation
product: linux
detection:
selection_node_shell:
ParentImage|endswith:
- '/node'
- '/bun'
CommandLine|contains|all:
- 'curl '
- '/tmp/ld.py'
- 'python3 '
- 'nohup '
- '6202033'
selection_curl_download:
Image|endswith: '/curl'
CommandLine|contains: 'http://sfrclak.com'
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_node_shell
selection_node_shell:
ParentImage|endswith:
- '/node'
- '/bun'
CommandLine|contains|all:
- 'curl '
- '/tmp/ld.py'
- 'python3 '
- 'nohup '
- '6202033'
Stage 2: selection_curl_download
selection_curl_download:
Image|endswith: '/curl'
CommandLine|contains: 'http://sfrclak.com'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Image | ends_with |
|
ParentImage | ends_with |
|