Executive brief
A malicious version of the axios-http npm package was published containing code that automatically collected and sent system information (OS details, hostname) to a remote attacker-controlled server. This represents a supply-chain attack where developers unknowingly installing this package would have their systems compromised and reconnaissance data exposed to attackers.
Technical details
The axios-http npm package contained embedded malicious code (CWE-506: embedded malicious code) that would execute upon installation or package initialization. The malware collected system reconnaissance information including OS type/version and hostname, then exfiltrated this data to a remote command-and-control server without user knowledge or consent. The attack required no authentication or user interaction—merely installing and using the package would trigger the compromise. The malicious code has since been removed; the advisory recommends complete removal of the package from affected environments.
Affected products
- npm axios-http 0.0.0+
Timeline
- 2020-09-03: disclosed
- 2020-08-31: other: GitHub advisory review