Security Axios

Security: Axios Supply-Chain Attack Scanner

Mission

Scan the entire Mac for the axios npm supply-chain compromise (2026-03-31). Check package.json and all lock files (package-lock.json, yarn.lock, pnpm-lock.yaml). Detect anti-forensics (dropper self-cleanup), related campaign packages, and verify RAT SHA256. Produce a full HTML threat report and open it automatically.

Background

On 2026-03-31, axios versions 1.14.1 and 0.30.4 were published via a compromised maintainer account (jasonsaayman, email changed to ifstap@proton.me) with an injected dependency plain-crypto-js@4.2.1. Its postinstall hook (setup.js) deployed a cross-platform RAT that beacons to sfrclak[.]com:8000 every 60 seconds. On macOS the RAT binary is /Library/Caches/com.apple.act.mond. The dropper self-destructs after execution: setup.js is deleted and package.json is replaced with a clean stub reporting version 4.2.0 — so post-infection node_modules inspection will NOT reveal the malicious manifest. The directory presence of node_modules/plain-crypto-js/ alone confirms the dropper ran.

The malicious dependency was pre-staged ~18 hours earlier by attacker account nrwise (nrwise@proton.me). A clean decoy version (4.2.0) was published first to build registry history. Both compromised axios versions were published manually with a stolen npm token — no OIDC Trusted Publisher binding, no gitHead, no corresponding GitHub commit or tag.

References

Threat Intelligence

Package SHA256 Hashes

Package SHA1 Shasums (npm)

Anti-Forensics Awareness

The dropper (setup.js) performs three cleanup actions after execution:

1. Deletes setup.js — fs.unlink(__filename) removes itself
2. Deletes package.json — removes the manifest with "postinstall": "node setup.js"
3. Renames package.md to package.json — a pre-staged clean stub reporting version 4.2.0

Post-infection, npm list shows plain-crypto-js@4.2.0 (not 4.2.1). Incident responders checking for version 4.2.1 may incorrectly conclude the system is clean. The reliable check is directory presence: if node_modules/plain-crypto-js/ exists at all, the dropper ran — this package is not a dependency of ANY legitimate axios version.

Our scanner checks:

• node_modules/plain-crypto-js/ directory existence (confirms dropper ran)
• node_modules/plain-crypto-js/setup.js presence (dropper not yet cleaned up)

Execution Flow

GREP PRE-FILTER → PARSE → LOCK FILES → RELATED PKGS → IOC CHECK → SHA256 VERIFY → LAUNCH PERSIST → REPORT → OPEN

What Is Scanned

False-Positive Notes

Process check FP risk: NEVER use ps aux | grep act.mond — a bash heredoc containing that string would match itself. Use pgrep -f "/Library/Caches/com.apple.act.mond" instead — pgrep excludes its own PID, and the script runs as python3 /tmp/file.py (no script content in command line).

Anti-forensics version mismatch: After dropper cleanup, npm list plain-crypto-js reports 4.2.0 (not 4.2.1). The scanner checks directory existence rather than version number.

Scripts

The scanner is split into focused modules under scripts/:

skills/security-axios/scripts/
├── axios_scan.py    # Entry point — orchestrates scan, IOC check, report
├── constants.py     # Threat intel: IOC hashes, versions, references, skip dirs
├── scanners.py      # Manifest/lock file parsers + find_and_scan walker
├── ioc_check.py     # System IOC checks: RAT, C2, globals, launch persistence
└── report.py        # HTML report generation: CSS, tables, badges, template

To run:

python3 /Users/guybary/Documents/skills/skills/security-axios/scripts/axios_scan.py

Module Reference

constants.py — Threat Intelligence Data

All IOC constants, SHA256 hashes, related campaign packages, skip directories, and reference URLs.

scanners.py — Manifest & Lock File Parsers

ioc_check.py — System IOC Detection

Checks performed:

• RAT binary existence + SHA256 verification against known hash
• pgrep -f for running RAT process (FP-safe)
• lsof -i for active C2 connections
• npm/yarn/pnpm global list for plain-crypto-js
• LaunchAgents/LaunchDaemons scan for persistence references

report.py — HTML Report Generation

Generates dark-themed HTML report with:

• Threat intel section (SHA256 hashes, campaign path, advisory IDs)
• Project tables with dropper evidence and related packages columns
• Source badges (📦 package.json · 🔒 lockfile · 🧶 yarn · ⚡ pnpm)
• References & Advisories section with all 8 source links
• Remediation steps including version pinning and CI/CD --ignore-scripts
• Footer with advisory links (GHSA, OSV, Snyk, Wiz, StepSecurity, Aikido)

Execution Instructions

When this skill is invoked:

1. Announce — scanning for the axios supply-chain attack (2026-03-31).

2. Run the scanner script directly — do NOT copy/paste inline:

python3 /Users/guybary/Documents/skills/skills/security-axios/scripts/axios_scan.py

3. What the script does:

   • Walk ~/ skipping node_modules, Library, caches, etc.
   • Use bytes-level grep pre-filter before full JSON/YAML parsing (fast)
   • Scan package.json, package-lock.json, yarn.lock, pnpm-lock.yaml per repo
   • Check for related campaign packages (@shadanai/openclaw, @qqbrowser/openclaw-qbot)
   • Detect dropper anti-forensics (directory presence vs setup.js presence)
   • Check macOS IOC with pgrep -f RAT_PATH (NOT ps aux | grep — avoids FP)
   • SHA256 verify RAT binary against known hash 92ff0877...c9645a
   • Check C2 connections via lsof -i
   • Check global npm/yarn/pnpm for plain-crypto-js
   • Scan LaunchAgents/LaunchDaemons for persistence referencing attack IOCs
   • Generate dark-themed HTML with source badges (📦 🔒 🧶 ⚡) and all references
   • Open in browser automatically

4. Print the terminal summary.

5. Verdict:

   • 🚨 SYSTEM COMPROMISED — RAT binary / C2 active / launch persistence
   • ⚠ VULNERABLE DEPS FOUND — compromised axios in lock files / package.json
   • ✅ CLEAN — no compromised versions, no IOCs

6. List each compromised repo with path, version, which file(s) confirmed it, and related packages.

Constraints

• NEVER output credential values from any scanned file.
• NEVER modify any files. Read-only scan.
• Skip node_modules/ when walking for manifests.
• FP rule: use pgrep -f RAT_PATH — never ps aux | grep act.mond.

Success Criteria

• All package.json + lock files scanned (outside node_modules)
• Compromised axios 1.14.1 / 0.30.4 detected in package.json AND lock files
• plain-crypto-js@4.2.1 detected in all manifest types
• Related campaign packages (@shadanai/openclaw, @qqbrowser/openclaw-qbot) detected
• yarn.lock and pnpm-lock.yaml scanned for resolved versions
• Anti-forensics detected (plain-crypto-js directory presence + setup.js check)
• macOS RAT IOC checked (binary + SHA256 verification + pgrep process + lsof C2)
• Launch persistence checked (LaunchAgents/LaunchDaemons)
• Global npm/yarn/pnpm checked for plain-crypto-js
• HTML report with source badges (📦 package.json · 🔒 lockfile · 🧶 yarn · ⚡ pnpm)
• HTML report includes all 8 references (Snyk, Wiz, StepSecurity, Aikido, GitHub Issue, GHSA, OSV, Elastic)
• HTML report includes SHA256 hashes and advisory IDs in threat intel section
• Report auto-opened in browser
• No false positives from process detection