Shares tags: NPM, Axios • Shares 14 IOCs • Published within a month
Axios npm package compromised to deploy malware
2026-03-31 • Sophos •
https://www.sophos.com/en-us/blog/axios-npm-package-compromised-to-deploy-malware
Sophos CTU reported that Axios versions 1.14.1 and 0.30.4 were compromised after an apparent npm maintainer account takeover and used to deploy a cross-platform RAT. The malicious dependency executed during installation, retrieved platform-specific second-stage payloads from C2 infrastructure, and attempted to remove artifacts and replace package metadata with a clean version. Sophos telemetry first detected related activity around 00:45 UTC on March 31, 2026, with macOS, Windows, and Linux systems affected but no confirmed follow-on actor activity at publication time. CTU assessed it was highly likely NICKEL GLADSTONE, a North Korea-linked revenue-focused state-sponsored group, was responsible based on matching forensic metadata, C2 patterns, and links to malware exclusively used by the group.
Indicators of Compromise
Related Reports
Shares tags: NPM, Axios • Shares 13 IOCs • Published within a week
2026-03-31 •
76% Match
Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads
Trend Micro
Shares tags: NPM, Axios • Shares 13 IOCs • Published within a week
Shares tags: NPM, Axios • Shares 13 IOCs • Published within a week
Shares tags: NPM, Axios • Shares 12 IOCs • Published within a week
Shares tags: NPM, Axios • Shares 11 IOCs • Published within a week