The Axios RAT: How a Compromised npm Account Backdoored 100 Million Downloads

The Maintainer Social Engineering That Made It Possible

The March 2026 Axios compromise began not with a technical exploit but with a social engineering campaign against Jason Saayman, Axios’s primary npm maintainer. Attackers impersonated a company founder, constructed a convincing fake Slack workspace complete with realistic channels and members, and arranged a Microsoft Teams call with apparently legitimate participants. Saayman was then persuaded to install a Remote Access Trojan under the pretext that a system update was required. Once Saayman’s machine was compromised, publishing malicious versions to npm required only the credentials his session held.

On March 30–31, 2026, the attackers published [email protected] (tagged “latest”) and [email protected] (tagged “legacy”) — targeting both current and legacy distribution channels to maximise exposure across projects pinned to either version track. Security researcher Joe Desimone posted urgently to X on March 31 after detecting anomalous behaviour. The two backdoored versions were removed from npm in approximately three hours.

In those three hours, Huntress observed over 135 affected endpoints across all operating systems connecting to attacker command-and-control infrastructure. Google attributed the campaign to UNC1069, a financially motivated North Korean threat cluster active since at least 2018.

The attack is significant not because Axios is unusually large — many packages have comparable download counts — but because it demonstrates that any package maintainer is a viable attack target regardless of the security posture of the registry itself. npm’s infrastructure was not compromised. The trust model was.

Technical Anatomy of the Cross-Platform RAT

Elastic Security Labs published the first detailed technical analysis of the malicious payload. The attack used a two-stage delivery mechanism.

Stage one — the dropper: The malicious Axios versions introduced a single new dependency: [email protected], which executed a postinstall hook automatically on npm install. The hook’s JavaScript file (setup.js) used two-layer encoding — string reversal followed by Base64 decoding, then an XOR cipher — to conceal its payload. Anti-forensic cleanup executed after the dropper ran: setup.js deleted itself and swapped the malicious package.json with a benign version 4.2.0 configuration containing no postinstall hooks, erasing evidence from node_modules inspection.

Stage two — the implants: The dropper downloaded platform-specific implants from sfrclak[.]com:8000:

• Windows: A PowerShell script (6202033.ps1)
• macOS: A compiled C++ binary (com.apple.act.mond)
• Linux: A Python script (ld.py)

All three variants shared an identical command-and-control protocol: HTTP POST with Base64-encoded JSON payloads, a 60-second beacon interval, 16-character random session identifiers, and a deliberately anachronistic user-agent string (“mozilla/4.0 compatible; msie 8.0; windows nt 5.1; trident/4.0”) that functions as the most reliable detection indicator — particularly anomalous on macOS and Linux systems.

The supported command set covered: self-termination (kill), script and command execution (runscript), binary payload delivery (peinject), and directory enumeration (rundir). Initial execution triggered comprehensive system reconnaissance: hostname, username, OS version, timezone, boot time, hardware model, CPU type, and complete process listings.

The macOS binary exhibited overlap with WAVESHAPER, a backdoor tracked by Mandiant and attributed to UNC1069. This attribution links the Axios campaign to a DPRK threat cluster with a documented history of financially motivated operations — including cryptocurrency theft and credential harvesting — targeting developer infrastructure specifically.

The Broader April 2026 Supply Chain Wave

The Axios compromise did not occur in isolation. It landed in the middle of a concentrated wave of supply chain attacks across multiple registries in March–April 2026.

In September 2025, a phishing attack on the developer “qix” compromised 18 npm packages targeting cryptocurrency transactions. The Shai-Hulud self-propagating worm stole and publicly uploaded unencrypted secrets to GitHub. In March 2026, the Axios campaign coincided with TeamPCP compromising Aqua Security’s Trivy container scanner, which subsequently spread to the npm ecosystem. Huntress’s April 2026 post-incident analysis documented a pattern: financially motivated threat actors — particularly DPRK-linked clusters — are systematically targeting the developer toolchain rather than end-user applications, because developer toolchain compromise achieves the highest downstream blast radius per unit of effort.

The itBrew analysis of the wave noted that supply chain attacks against open-source projects represent a category where traditional security controls — perimeter firewalls, application-layer WAFs, endpoint antivirus — provide essentially no protection. The malware arrives packaged inside a tool that the target actively requested, installed by the target’s own build system, into the target’s own development or production environment.

What Engineering Leaders Must Change About How They Manage Dependencies

1. Treat “Latest” as an Untrusted Tag in Any Production Pipeline

The Axios attack exploited the npm default resolution of the “latest” tag. Any package.json specifying "axios": "^1.13.0" or "axios": "latest" automatically received the backdoored 1.14.1 release on the next npm install. Engineering leaders must enforce exact version pinning for all production dependencies — replacing range specifiers (^, ~, >=) with exact version numbers — and commit a lock file (package-lock.json, yarn.lock, or poetry.lock) to source control. CI/CD pipelines must be configured to fail if the lock file has drifted from package.json without an explicit update commit.

This is not a new recommendation. It predates the Axios incident by years. The fact that 135+ affected endpoints were observed during a three-hour window means that a significant fraction of production npm consumers were not using pinned versions or lock files in CI/CD. “Latest” is a convenience for development environments; it is a liability in production pipelines.

2. Implement Package Provenance Verification and Signed Releases as a Deployment Gate

npm provenance (supported from npm 7+) cryptographically links a published package version to the specific GitHub Actions workflow that produced it. Packages with provenance attestation can be verified to have been built from a specific, identified source commit. While Jason Saayman’s account compromise would still have allowed the attacker to publish a provenance-attested package (since they controlled the account), provenance verification combined with repository monitoring — alerts on unexpected package publishes outside normal commit patterns — creates a detection layer that the Axios incident would have triggered earlier.

At the registry level, the answer is more fundamental: package registries must move toward account security requirements (hardware MFA, passkeys) that resist social engineering at the same level as corporate identity providers. npm’s current MFA requirements are insufficient for high-download-count packages. The OpenSSF (Open Source Security Foundation) has published tooling — Sigstore and SLSA (Supply Chain Levels for Software Artifacts) — that provides a cryptographic verification framework for package builds. Mandating SLSA Level 2 for any package above 10 million weekly downloads would have prevented the Axios RAT from publishing without a verifiable build provenance.

3. Audit Transitive Dependencies, Not Just Direct Dependencies

Most engineering teams that conduct dependency audits focus on their direct package.json entries. The Axios attack used a transitive dependency — [email protected], which was introduced by the malicious Axios version — as the actual malware dropper. The malicious code was not in Axios itself; it was in a package that Axios pulled in, which most security tools scanning package.json would not have flagged before npm install completed.

Transitive dependency auditing requires running npm audit after install (not before), reviewing the full dependency tree, and implementing SBOM (Software Bill of Materials) generation for every build. Tools including Syft, cdxgen, and OWASP Dependency-Track generate full SBOMs from installed node_modules in under 30 seconds. An SBOM from the pre-incident production build, compared against an SBOM from a fresh install, would have immediately surfaced [email protected] as a new, unexpected transitive dependency — the earliest possible automated detection signal for this attack class.

The Structural Question: Can Package Registries Be Trusted?

The Axios compromise forces an uncomfortable architectural question. The open-source package registry model assumes that package maintainers are trustworthy, that registry infrastructure is secure, and that downstream consumers can evaluate trust by examining download counts and community reputation. The Axios attack invalidates all three assumptions simultaneously: a trusted maintainer was socially engineered, the registry infrastructure was not compromised but was used as a distribution channel, and 100 million weekly downloads conferred trust that the attack specifically exploited.

The structural answer is not to abandon open-source dependencies — the productivity cost would be prohibitive. It is to redesign the trust model: treat every package as potentially compromised until verified via cryptographic provenance, enforce exact version pinning and lock files as non-negotiable CI/CD gates, and implement transitive dependency monitoring as a standard build step rather than an occasional security audit.

DPRK-linked threat actors have demonstrated sustained interest in developer infrastructure since at least 2018. The Axios campaign is not a one-off incident — it is an escalation in a documented campaign. Engineering leaders who have not redesigned their dependency trust model are not waiting for the next attack; they are in its blast radius.

Frequently Asked Questions

Sources & Further Reading

• Axios: One RAT to Rule Them All — Elastic Security Labs
• Axios npm Compromise — Huntress
• Supply Chain Compromise Impacts Axios Node Package Manager — CISA
• Supply Chain Attack Against Open Source Projects Could Have Big Impact — itBrew
• Trivy Supply Chain Compromise Enters Extortion Phase — Halcyon AI