Full transcript
0:00Now, normally I wouldn't record a video
0:01like this, but considering the size,
0:04scale, and severity of this incident, I
0:06thought being faster, being more rapid
0:09in a rapid response response would
0:11probably be a good thing. Because there
0:13has been a supply chain compromise of
0:16the Axios library. Basically, ubiquitous
0:20like just about every JavaScript running
0:22application or solution uses this
0:25package and this library in the NPM
0:27package and repository. And the thing
0:29is, we have seen and confirmed hosts
0:32have been compromised. This is literally
0:34a rough draft of the blog post and
0:36article that I'm thinking, hoping,
0:38presumably Huntress, my day job, will
0:40put out. And I did want to note, look,
0:43uh we I I crapped this together with a
0:45little bit of AI. Wanted to be totally
0:47up front, transparent with that. Gave it
0:48enough context from what I dug into
0:50during our live stream to investigate
0:52this breaking in the moment when the
0:54news was first hitting the streets. But
0:56we have observed active exploitation of
0:58a supply chain compromise targeting the
1:00Axios NPM package. It has over 100
1:02million weekly downloads. Now, the
1:04attack delivers a cross-platform like
1:06Windows supported, Linux supported, and
1:08Mac supported remote access Trojan or
1:11command and control capability to access
1:13the downstream victims. And they do this
1:16with a malicious dependency injected
1:18into the backdoored Axios release.
1:20Versions 1.14.1
1:23or 0.30.4
1:25are the malicious packages. Ultimately,
1:27these funnel down to that phantom
1:29dependency of plain-crypto-js
1:33version 4.2.1. That plain-crypto-js,
1:38presumably trying to typosquat off of
1:40legitimate crypto-js,
1:42did not exist previously. And it is
1:44never really genuinely used by Axios
1:47code. It literally was just to execute a
1:51You guessed it, post-install script that
1:53runs the malware. For folks that aren't
1:55familiar with what Axios is, it is a
1:58promise-based HTTP client. But I was
2:01alluding to the fact that it is just
2:03about everywhere. It's a transitive
2:04dependency for countless packages, and
2:07of course, CI/CD, continuous
2:08integration, or whatever that I letter
2:10supposed continuous deployment,
2:12continuous delivery pipelines, developer
2:14workstations, and production
2:15applications worldwide. Any environment
2:18that ran npm install or actually updated
2:21and resolved to the malicious Axios
2:24version during the time that it was
2:26alive and published on the npm registry
2:29and repository, about 3 hours of
2:31exposure, those hosts are compromised.
2:33While the packages have now been removed
2:36from npm, okay, we've stopped the
2:37bleeding, treat for shock, there are
2:39still hundreds of hosts, if not
2:41thousands, as I'm sure we'll see more
2:43come out of the woodwork for further
2:44post-exploitation in the coming days,
2:46but the damage is done. What happened
2:49was that an attacker gained access to
2:51one of the maintainers or contributors
2:54access to their npm account in the
2:56open-source Axios library. Switched up
2:59their email address, bypassed normal
3:01GitHub actions control with a long-lived
3:04access token, and a little bit of a
3:06breadcrumb in there, but the maintainer,
3:09Jason, is saying even in GitHub issues,
3:11this is a wild saga. If you haven't
3:13looked through this, you absolutely
3:14should. It's kind of crazy. But there's
3:16a segment here as folks are discussing
3:19this nice meme. The remaining items, you
3:21can see Jason does chime in, and he
3:24says, "Oh, man. Hey, I'm sorry. It's
3:255:00 a.m. in my country. I'm looking
3:26into this." Everyone's like, "You got
3:28this. We bring to arms." I'm trying to
3:30get support to understand how this even
3:32happened. I have two-factor
3:33authentication, multi-factor on
3:35basically everything I interact with. So
3:37far, as this is still breaking news, I
3:39don't think we really know exactly how
3:41the account was compromised and how bad
3:43actors got into Jason's capability and
3:45access to the library, but I'm waiting
3:47for that root cause analysis.
3:49Interesting thing though, that
3:50plane-dash-crypto
3:52package was prepared a bit before it
3:56fired, adding it into upstream Axios,
3:58right? Little bit of a timeline here
4:00where you can see when the actual
4:01malicious package that is called out to
4:04and in part of Axios now, and the delta
4:07in the minutes, the seconds, the moments
4:09here are kind of wild because
4:11internally, right, when we're protecting
4:12partners, organizations, and companies,
4:14look, we see, okay, that hit a minute
4:17and a half after it's published and one
4:20Mac OS host is already host. Sometime
4:23after we're catching wind for Windows
4:25infections, but the fact that this
4:27trickles down and with it only being
4:29alive on NPM for sure an hour, two
4:31hours, three hours, whatever, it's going
4:33to have severe size and scale because
4:36how many packages, applications,
4:38runtimes, CICD pipelines genuinely rely
4:41on Axios. And it hits in a minute and a
4:44half. Wild attack. The gimmick here is
4:48that the setup.js or the syntax and code
4:51that's actually fired as the post
4:53install hook has a little bit of oh
4:55cutie reverse base 64 XOR, some decoding
4:58and decrypting that it might do to hide
5:00away the rest of the syntax and what
5:02it's going to actually do depending on
5:04the platform that it's in. Now, in case
5:06you're curious, we have the payload and
5:08I've staged that in a GitHub gist. You
5:10can see that here and if this gets
5:12published, it'll be embedded within the
5:14blog post. But, in case you want to see
5:15what it looks like, this is the smoking
5:18gun.
5:19That syntax ends up staging either the
5:22Windows remote access Trojan or the
5:24Linux or Mac one and the process
5:27execution chain is a little bit
5:28interesting here because that setup.js,
5:31once it fires, it's going to write a
5:32Visual Basic script tucked away hidden
5:34window, actually put powershell.exe
5:37to what folks might consider wt.exe as
5:40the Windows Terminal, natural now modern
5:43Windows 11, if just so the process chain
5:45doesn't look as weird for an
5:47or SIM or seam solution. We'll still
5:49catch the fact, "Hey, that's running out
5:50of an irregular directory." and then
5:52it's doing weird cmd.exe commands to
5:55curl down and actually post data with
5:57another strange-looking URL in there.
5:59That's another little clever trick to
6:01just look like natural data, but
6:03actually hitting a command and control
6:05interface. sfrclack.com
6:08on port 8000 with a little campaign ID
6:11or interesting sort of key here ends up
6:13staging the PowerShell script to do more
6:15damage and then it covers its tracks
6:18after it executes and fires the next
6:21stage payload. You can see the process
6:23picture here. The RAT on Windows does
6:26end up setting persistence in the
6:27Windows registry with the usual a kind
6:29of classic cookie-cutter classic auto
6:32run startup location in HKCU or the
6:34current user. So, local privileges to
6:36add that. And then it ends up looking
6:38through your file system to uncover your
6:40documents, desktop, OneDrive, roaming
6:42app data, and file system drive roots
6:44and then it ships that off to the
6:46command and control C2 and starts to
6:48loop to keep operating as the maintain
6:51access. It has some handlers, so
6:53remotely via the command and control to
6:55drive the now victim computer that the
6:58hacker has compromised, they could kill
7:00the engine. They could inject and run
7:02more code with some .NET assemblies and
7:05maybe getting some stuff in memory. Or
7:06they could run even more PowerShell
7:08scripts or just explore more directories
7:11and dig into files. Again, I do have the
7:13Windows payload just if you're
7:15interested. That is pure PowerShell. The
7:16whole payload is available on that
7:18GitHub gist and you can see everything
7:20that they did. But, if you wanted to
7:22scroll through it together with me, uh
7:24you can catch that as part of the live
7:25stream bot or hang out when we're live
7:27streaming together. It's a lot of fun.
7:29And I don't want to fall down the rabbit
7:30hole on all of the technical details
7:32even in the macOS or Linux direction.
7:35The Linux one uses a Python-based RAT,
7:37but it's basically going to end up doing
7:39the almost exact same thing the Windows
7:41does syntactically, right just in the
7:43Python flavor rather than PowerShell,
7:45but it does not actually add
7:47persistence. There was no like, "Oh,
7:49hook it into a bashrc or setting up some
7:51cron job or anything weird." It just
7:53kind of runs. So, if you were to end up
7:55stopping that process, if you could
7:57track it down, if you could find those
7:58indicators of compromise, if you could
8:00even restart the thing, but you got to
8:02keep in mind that is intentionally
8:03likely built to be inside of a CICD
8:07pipeline where the sensitive secrets are
8:09kind of all that they're after. They're
8:11not expecting something to be shut down
8:13or rebooted or even monitored because
8:14it's probably part of some scaffolding,
8:16part of a production application that
8:18you never turn off in the first place.
8:20But, I don't know if you caught it, but
8:22it stuck out to me. I thought it was, I
8:23don't know, maybe an Easter egg, maybe
8:25just something silly, but the campaign
8:27ID or the path they keep using, the
8:29numbers 6202033.
8:33Hmm.
8:34If you end up reversing that, the
8:36numbers 330
8:39and 2026 point to March 30th, 2026,
8:44exactly when the supply chain fired off.
8:46I thought that was neat or at least a
8:48little bit peculiar. Now, in the post
8:50bodies that are designed to mimic
8:52regular NPM like package repository
8:55communication and traffic, the data that
8:58you might have seen attached to the body
8:59of a post request is actually the
9:01indicator so that server-side they're
9:03able to switch off and toggle, okay,
9:05what variant are we actually going to
9:07install and deploy? Is it the
9:08Linux-based payload? Is it the
9:10Windows-based payload? Is it the macOS
9:11one? But, they make it a little bit
9:13clever because that's not the real
9:15npmjs.com.
9:17In fact, it's just some other random red
9:20herring look-alike data just to look
9:22like something. But, I was falling down
9:24the rabbit hole because I was kind of
9:25stoked about, hey, our own security
9:28operations center and our analysts that
9:30were actually tracking this thing and it
9:32caught it basically even concurrent with
9:35this unfolding before the public
9:38sounding the alarm and everyone
9:39screaming and shouting on Twitter, we're
9:41actually seeing the evidence of hey, us
9:44tracking it down, again, 89 seconds
9:47after it pops. Wanted to credit the SOC
9:50analysts because truly they're the ones
9:51doing the real work. I am a mere parrot
9:54just regurgitating their incredible
9:56effort. So, absolutely shine the
9:58spotlight on them, giving them credit,
9:59kudos, and credit where credit is due.
10:01But, it's hysterical to a certain
10:03extent. I I saw this fly by and I just
10:05thought it was so perfect because
10:06everyone's having the realization, "Wow,
10:08we've had AI, you know, consume our
10:10whole world in that oh, everyone npm
10:13installs just about everything now. The
10:15supply chain is an absolute abyss and
10:17we're curl piping to bash all the time
10:19now. Whether it's open claw, whether
10:21it's WordPress, whether it's whatever."
10:23Chad says, "Look, is npm cooked? Are we
10:26cooked right now?" All that is to say,
10:28it was cool to see, look, we're already
10:30tracking this thing the moment that it
10:32breaks and we're already getting the
10:33full picture. Okay, we are seeing the
10:35actual compromises, at least a hundred
10:37from what we have visibility over,
10:39mainly in the macOS ecosystem and I'm
10:41sure plenty in the Linux world as well.
10:43But again, this has some wild
10:45implications and a bit of a blast radius
10:47here that I thought it was kind of worth
10:50going live at 1:00 in the morning,
10:52midnight, 2:00 a.m. to kind of scream
10:53and shout about this because I want to
10:55make sure you are aware and how you can
10:57mitigate. First things first, if you are
10:59working with these packages, look,
11:01double-check your lock files,
11:02double-check your like package.json and
11:04the running lock association to make
11:06sure you're not using any of the
11:08malicious packages or any rendition of
11:10that back or any malicious package here.
11:13Look for them across your environment
11:14and I did want to give the shout-out and
11:15love to Step Security who I think helped
11:17really first sound the alarm on this
11:19thing. So, look for this across all of
11:21your hosts, but realistically, also look
11:23for those indicators of compromise
11:25because that's how you know, okay, one
11:26host could still just as easily be hosed
11:28if that hasn't been like rotated,
11:30recycled, maybe reformatted if you want
11:31to go to that extent, if you're not
11:33rotating credentials and everything,
11:35assume it is compromised because
11:38someone's NPM account got taken over.
11:40This wasn't a CVE, this wasn't a
11:42vulnerability, this wasn't an exploit,
11:44it wasn't some zero-day, it was, "Hey,
11:47we are
11:48falling on our own sword as to what the
11:50infrastructure of the internet and
11:52software is right now." It felt good to
11:55play a part of this though, it felt good
11:57to jump in for some of that rapid
11:59response and I hope that I'm still
12:01giving you some good valuable insight.
12:03The blog, of course, will be out and
12:04about. I did want to get this extra
12:06early rapid rapid response video so that
12:08folks can be aware of this when they
12:10wake up in the morning and we have some
12:12of the indicators of compromise here
12:13just as well, if you wanted to be able
12:15to extract those out and go do your own
12:18due diligence. But, please, please,
12:20please, goodness gracious, supply chain
12:22shenanigans hitting the streets again.
12:24Everybody in the industry has jumped
12:26onto this. Socket Security shared their
12:28blog and they're monitoring the
12:29situation. Step Security is still
12:31sharing some incredible stuff on this
12:33front. Acaido, Akido, I'm sorry, I get
12:35it wrong every time. You guys know,
12:36we're friends though. Joe from over at
12:38Elastic has some incredibly good insight
12:40just as well, so I I'll include links in
12:43the video description for all of these
12:45things that I've been researching and
12:47referencing here for you and I hope you
12:49can get yourself a little more oriented
12:51in how this Axios NPM supply chain is
12:55going to unfold. The latest from Jason,
12:57about 10 minutes ago as I'm recording
12:59actively trying to help spread the word.
13:01This is the individual that had their
13:02NPM account taken over that let the bad
13:04actor and hacker push to NPM and do the
13:07supply chain for the Axios library. It
13:09seems to me that someone used one of my
13:11recovery codes. How is this even
13:13possible is beyond me. Look, please let
13:16me know, what do you think? Do you
13:17agree? Do you disagree? Am I going a
13:19little bit crazy thinking, "Whoa, this
13:21is whatever, I don't know, blue screen
13:22of death on every computer?" Is this
13:24another log 4j falling from the sky? I I
13:27do think though this could very well
13:30explode and we will see
13:31post-exploitation and maintained access
13:34just coming out of the woodwork for the
13:36next day or two or week or however many
13:39day or two weeks. I don't know. Uh if
13:42anything I think this is just wow a
13:43story to tell. Axios compromised then
13:47that's every That's what I know as the
13:50go-to tool to do this in JavaScript to
13:53communicate with websites. So this
13:55is
13:56wake-up call, slap in the face, whatever
13:58buzzword we want. And I think we're
13:59going to see a heck of a lot more supply
14:01chain compromises just like this with
14:03the old robots running around.