Unit 42 researchers detail a supply chain attack targeting the Axios JavaScript library after an npm maintainer account was hijacked. Malicious versions v1.14.1 and v0.30.4 injected a hidden dependency called plain-crypto-js, which acted as a cross-platform RAT affecting Windows, macOS, and Linux. The dropper used obfuscation (Base64, XOR), triggered via npm postinstall hooks, and fetched platform-specific payloads from a C2 server. All three OS variants shared the same RAT framework with identical C2 protocol. The attack overlaps with DPRK-linked threat actor WAVESHAPER. Forensic cleanup occurred within 15 seconds of installation. Mitigations include auditing for compromised versions, rotating all credentials, pinning dependencies to safe versions, blocking C2 traffic, and hardening CI/CD pipelines with --ignore-scripts.
