The package originally described in this article's first version - react-utils-core, compromised to deliver XWorm RAT - does not exist in the public npm registry. That version has been withdrawn. In its place: a real npm supply-chain compromise from late March 2026 that followed a similar playbook, against a far larger package. It did not deliver XWorm. This page keeps its original URL slug from the withdrawn version (it was never published, so no real inbound links depend on it), but the malware family described below is a different one entirely.
//What Happened
Axios is a widely used JavaScript HTTP client. In late March 2026, attackers took over a lead maintainer's npm account and published two poisoned releases - [email protected] and [email protected] - within 39 minutes of each other. One report describes the publish as going directly from the compromised account, bypassing the project's normal CI/CD pipeline.
The only functional change in the poisoned versions was a single new dependency added to the package manifest: [email protected], a package built to look like the legitimate crypto-js library. The npm package of that name is never actually imported anywhere in Axios's own source - its only job was a postinstall script, which ran automatically the moment anyone installed the poisoned Axios version.
What the postinstall script did
The script contacted a command-and-control server at sfrclak.com, downloaded a platform-specific remote access trojan for macOS, Windows or Linux depending on what it was running on, and then attempted to remove evidence of its own execution. One report describes the macOS payload as disguised as a system daemon named com.apple.act.mond, mimicking Apple's own naming convention for background services.
//Staging and Detection
The attackers appear to have prepared the ground in advance: a clean, harmless decoy version of plain-crypto-js was published on 30 March, building up ordinary-looking registry history before the malicious payload went live. Socket's automated malware detection flagged the suspicious package at 00:05:41 UTC on 31 March - about six minutes after it was published.
Sources disagree on the exposure window and scale. One report puts the malicious package chain's active window at roughly three hours, 00:21 to around 03:25-03:29 UTC (sources give slightly different removal times), before npm removed the compromised versions. Another states the poisoned versions were installed by more than 10,000 users before removal. Reported weekly download figures for Axios itself also vary widely across outlets - from roughly 3 million to over 100 million - so any of these specific numbers should be treated as approximate rather than settled.
As of the RHISAC report checked for this rewrite, no threat actor had been publicly confirmed as responsible. One separate vendor report classifies the macOS payload as NukeSped, a backdoor family that vendor attributes to the Lazarus Group - a single-sourced attribution this rewrite could not corroborate elsewhere, so it should be treated as unconfirmed rather than established. Other reports describe the malware only generically, as a cross-platform RAT, and assess a possible espionage motive from its capabilities without naming an actor.
The C2 domain is identified as sfrclak.com on port 8000. Platform payloads differed: on macOS the binary was written to /Library/Caches/com.apple.act.mond; on Windows, a copy of PowerShell was dropped as %PROGRAMDATA%\wt.exe; on Linux, a Python script was saved to /tmp/ld.py. The compromised versions were removed from the registry at 03:29 UTC on 31 March 2026; the safe versions to use are [email protected] and [email protected].
//Why This Keeps Happening
The pattern here - compromise a maintainer's account, add one new dependency whose only purpose is a postinstall hook, let that hook fetch the real payload after the fact - does not depend on finding a vulnerability in the target package's own code at all. Axios's source was reportedly unchanged; the malicious logic lived entirely in a package that was never audited because nobody had reason to look at a brand-new, innocuous-sounding dependency added in a routine-looking release. Any install pipeline that runs postinstall scripts automatically, which is the npm default, is exposed to this shape of attack regardless of how carefully the target package itself is reviewed.