Supply chain compromise affecting Axios
Axios is a javascript library for easily making HTTP requests, both in the browser and in node.js applications. It is primarily used to easily communicate with APIs, simplifying sending and receiving data (often in JSON), error handling, query configuration, and authentication. It is one of the most used libraries, with 100 million downloads weekly.
Description
Technical context and vulnerability details
Following the compromise of the npm account of jasonsaayman, the main maintainer of the axios project, a malicious actor released two corrupted versions of the library, identified as axios@1.14.1 and axios@0.30.4, incorporating a malicious dependency named plain-crypto-js@4.2.1. The role of this malicious package is to execute a post-installation script that acts as a malware dropper allowing remote access to affected systems. This compromise would allow a malicious actor to execute arbitrary code remotely on systems using corrupted versions of the Axios library.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Code Execution;
- Data privacy breach;
- Data integrity compromise;
Affected systems
Products, components and targeted versions
- Any system with Axios versions 1.14.1 and 0.30.4;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Use a version older than axios@1.14.1 and axios@0.30.4;
INDICATORS OF COMPROMISE:
- Sfrclak.com
- 142.11.206.73
- hxxp[://]sfrclak[.]com:8000/6202033
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.