Skip to content

Frequently Asked Questions About the Axios npm Supply Chain ...#2083

Open
carlospolop wants to merge 1 commit intomasterfrom
update_Frequently_Asked_Questions_About_the_Axios_npm_Sup_20260402_020436
Open

Frequently Asked Questions About the Axios npm Supply Chain ...#2083
carlospolop wants to merge 1 commit intomasterfrom
update_Frequently_Asked_Questions_About_the_Axios_npm_Sup_20260402_020436

Conversation

@carlospolop
Copy link
Copy Markdown
Collaborator

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

🎯 Content Summary

Frequently Asked Questions About the Axios npm Supply Chain Attack (UNC1069): technical, step-by-step summary


What happened (timeline + scope)
On March 31, 2026, an attacker published two malicious versions of the popular axios npm package to the npm registry: axios@1.14.1 and axios@0.30.4. Axios is extremely prevalent (the post cites ~100M+...

🔧 Technical Details

npm supply-chain RCE via dependency lifecycle scripts: If you can inject a dependency into a widely used npm package, you can obtain code execution without modifying or being imported by the main library by relying on the dependency’s postinstall script. When victims run npm install (including in CI runners), the lifecycle hook executes automatically, enabling droppers to fetch and run platform-specific payloads.


Obfuscating Node.js droppers with layered decoding + dynamic imports: Hide C2 strings and commands using multiple transforms (e.g., reversed Base64 followed by XOR with a hardcoded key/constant), then dynamically load modules like fs/os/execSync to reduce static signatures and complicate quick source review.


Anti-forensic “manifest laundering” in installed packages: After executing, remove obvious on-disk indicators by deleting the drop...

🤖 Agent Actions

I’m mapping the repository first, then I’ll read the most relevant package-manager and CI/CD pages to decide whether this belongs in an existing Node/npm supply-chain page or if there’s a real gap.
I found an existing page that is already very close to the blog’s technique: dependency-confusion.md. I’m reading a few more related pages to confirm whether the missing value is specifically npm lifecycle-hook RCE, anti-forensics, and trusted-publisher detection rather than generic dependency confusion.
The gap is now clear: HackTricks already explains name-resolution abuse, but not the closely related case where a legitimate npm package is compromised and gains install-time RCE through a never-imported dependency plus lifecycle hooks. I’m patching that into the existing dependency-confusion page, along with practical detection points for OIDC/trusted-publisher pipelines and release-age controls.
Updated dependency-confusion.md.

I kept the content in a single existing file and added the missing technique-level material from the Axios incident: install-time RCE via injected npm lifecycle-script dependencies, the “dependency-only” execution model, Node dropper obfuscation plus manifest laundering, trusted-publisher/OIDC mismatch detection heuristics, and release age-gate controls for npm/pnpm/Yarn/Bun. I did not create a new page because the technique fits the existing supply-chain/dependency-abuse page better than a new generic section.

I also updated the file’s ## References with the Tenable post and relevant official docs. Verified the final diff and structure; no tests were needed for this markdown-only change.


This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

@carlospolop
Copy link
Copy Markdown
Collaborator Author

🔗 Additional Context

Original Blog Post: https://www.tenable.com/blog/faq-about-the-axios-npm-supply-chain-attack-by-north-korea-nexus-threat-actor-unc1069

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources -> Phishing Methodology / or a new section under Generic Hacking or Web -> Supply Chain Attacks (npm/yarn) / CI build-time RCE via npm lifecycle scripts (postinstall/preinstall); also cross-link from Pentesting CI/CD methodology (external link) if appropriate".

Repository Maintenance:

  • MD Files Formatting: 964 files processed

Review Notes:

  • This content was automatically processed and may require human review for accuracy
  • Check that the placement within the repository structure is appropriate
  • Verify that all technical details are correct and up-to-date
  • All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant