A malicious npm dependency smuggled into trusted axios packages.
Download the full case study
Get the complete PDF version of this Tales from the SOC story.
Threat Type: npm supply-chain compromise (axios)
Target: Developer build host, energy sector
OS Targeted: macOS · Windows · Linux
Rather than altering Axios source code, the adversary injected a malicious runtime dependency — plaincryptojs@4.2.1 — into the package configuration of axios versions 1.14.1 and 0.30.4. An obfuscated postinstall script executed during routine dependency resolution (npm install / npm ci). Because the packages were published with a legitimate maintainer's credentials, the activity bypassed upstream CI/CD controls and appeared authentic at install time.
Detection: Microsoft Defender for Endpoint (MDE) and CrowdStrike fired an influx of alerts flagging process masquerading and suspicious PowerShell with characteristics of Fake CAPTCHA and SocGholish campaigns.
SOC Escalation: Escalated high priority. Command-line data ingested through CORR revealed outbound HTTP requests to a malicious domain (sfrclak[.]com:8000), confirming an active command-and-control (C2) channel rather than benign developer activity.
Analysts confirmed the postinstall script acted as a cross-platform malware dropper — performing environment checks, deobfuscating payloads in memory, and pulling platform-specific second-stage payloads from the C2 endpoint. The malware showed anti-forensic behavior including self-deletion and metadata restoration to reduce post-incident visibility. The SOC tied the activity to the broader axios npm supply-chain attack and gave the customer clear, long-term mitigation guidance.
Malicious dependencies developed for the Axios HTTP Client by the attacker
Postinstall script executed via malicious dependency, acting as a remote trojan dropper
Renamed binary executes to evade detection, running a PowerShell script
Outbound HTTP requests confirm active command-and-control channel
MDE and CrowdStrike fired an influx of alerts flagging suspicious activity
Critical Start immediately notified the customer and ensured the endpoint was isolated, along with blocks outbound to the C2 address
The Critical Start SOC removed the host from the customer's network and blocked all communication with the attacker's infrastructure before a second-stage payload could land. The customer received researched threat detail and a recommendation to find and remove the compromised package, audit for further compromise, and reimage the host — turning a stealthy supply-chain intrusion into a contained, well-understood event.
© 2026 Critical Start. All rights reserved.
