Axios NPM Compromise Indicators - Linux
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection_node_shell:
ParentImage|endswith:
- '/node'
- '/bun'
CommandLine|contains|all:
- 'curl '
- '/tmp/ld.py'
- 'python3 '
- 'nohup '
- '6202033'
selection_curl_download:
Image|endswith: '/curl'
CommandLine|contains: 'http://sfrclak.com'
condition: 1 of selection_*False positives are unlikely for most environments. High confidence detection.
Tactics
Techniques
Other