As cited
Copy frozen at (site build).
threat intel
Elastic releases detections for the Axios supply chain compromise
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Elastic releases detections for the Axios supply chain compromise
Elastic Security Labs released detection rules for a supply chain compromise affecting Axios package versions 1.14.1 and 0.30.4, which introduced a malicious transitive dependency (plain-crypto-js@4.2.1) that executes during npm install. The attack deploys platform-specific remote access trojans (RATs) across Linux, Windows, and macOS by leveraging a consistent pattern: Node.js spawns native OS shells to retrieve and execute secondary payloads from command and control infrastructure at sfrclak.com. Elastic's behavioral detections target this execution chain rather than static indicators, providing reliable coverage across all affected platforms.
Why it matters: Organizations using Axios versions 1.14.1 or 0.30.4 face immediate compromise risk from RATs that establish persistent backdoor access, exfiltrate system data, and accept attacker commands; practitioners should immediately audit package versions, review endpoint telemetry for the detection signatures provided, and isolate affected systems.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Elastic releases detections for the Axios supply chain compromise
Elastic Security Labs released detection rules for a supply chain compromise affecting Axios package versions 1.14.1 and 0.30.4, which introduced a malicious transitive dependency (plain-crypto-js@4.2.1) that executes during npm install. The attack deploys platform-specific remote access trojans (RATs) across Linux, Windows, and macOS by leveraging a consistent pattern: Node.js spawns native OS shells to retrieve and execute secondary payloads from command and control infrastructure at sfrclak.com. Elastic's behavioral detections target this execution chain rather than static indicators, providing reliable coverage across all affected platforms.
Why it matters: Organizations using Axios versions 1.14.1 or 0.30.4 face immediate compromise risk from RATs that establish persistent backdoor access, exfiltrate system data, and accept attacker commands; practitioners should immediately audit package versions, review endpoint telemetry for the detection signatures provided, and isolate affected systems.
- Source published
- First seen by Cybersecurity Tracker