Sigma rule: Axios NPM Compromise Indicators - Linux

Rule

Title

Axios NPM Compromise Indicators - Linux

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-04-01

File

rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_lnx_axios_npm_compromise_indicators.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency ([email protected]) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Log source

product

linux

category

process_creation

Detection

selection_node_shell:
    ParentImage|endswith:
        - '/node'
        - '/bun'
    CommandLine|contains|all:
        - 'curl '
        - '/tmp/ld.py'
        - 'python3 '
        - 'nohup '
        - '6202033'
selection_curl_download:
    Image|endswith: '/curl'
    CommandLine|contains: 'http://sfrclak.com'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.initial-access
• attack.t1195.002
• attack.execution
• attack.command-and-control
• attack.t1059.006
• attack.t1059.004
• attack.t1105
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1059.004
• T1059.006
• T1105
• T1195.002

References

• https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
• https://www.derp.ca/research/axios-npm-supply-chain-rat/
• https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
• https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
• https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_lnx_axios_npm_compromise_indicators.yml