Hackers Use Poisoned Axios Package and Phantom Dependency to Spread Cross-Platform Malware

Summary of the Cyber Attack Involving Axios Package

Overview:

A sophisticated cyber attack has been reported where hackers poisoned a widely-used npm package, axios, to spread cross-platform malware. The attack leveraged a phantom dependency called plain-crypto-js to execute malicious payloads on macOS, Windows, and Linux systems.

Key Points:

1. Poisoned Axios Package:

   • Hackers compromised the axios package by injecting a malicious script into its postinstall hook.
   • The attack targeted specific versions: [email protected] and [email protected].

2. Phantom Dependency (plain-crypto-js):

   • A phantom dependency, plain-crypto-js, was introduced to the package.json file of axios.
   • This phantom dependency caused npm to install a malicious version of plain-crypto-js.

3. Malware Payloads:

   • The malicious script executed during installation detected the operating system and downloaded corresponding payloads.
     • macOS: An AppleScript was used to fetch and execute a binary, mimicking an Apple system daemon.
     • Windows: A VBScript launcher ran a PowerShell RAT entirely

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.