Software Supply Chain Security
Attention, Lobster-men! Axios has been poisoned, and we intercepted it 41 minutes ahead of npm official
Axios Supply Chain Poisoning Full Analysis & Enterprise Long-term Defense System Construction
The Story Starts with OpenClaw
Yesterday morning, a large number of developers and security engineers using OpenClaw received warnings one after another:
Users who normally installed or updated OpenClaw between 8:00–12:00 AM Beijing time today may have been passively implanted with a cross-platform RAT remote control Trojan.
Users who normally installed or updated OpenClaw between 8:00–12:00 AM Beijing time today may have been passively implanted with a cross-platform RAT remote control Trojan. This is not a vulnerability in OpenClaw itself. The root cause points to a component in the JavaScript ecosystem that you use almost every day - Axios. Axios is the world's number one HTTP client library by npm downloads, with over 100 million weekly downloads. It is a standard dependency for React, Vue, Angular frontend projects and Express, NestJS backend services. It is so basic that many tools you use - including OpenClaw - rely on it under the hood, and you might not even know it exists. On March 31, 2026, an attacker hijacked the npm account of Axios's chief maintainer and pushed two malicious code-implanted versions to the official registry: axios@1.14.1 and axios@0.30.4. Any project that ran npm install during the infection window, as long as it allowed pulling these two versions, may have been implanted with a backdoor without knowing it. This is exactly why OpenClaw got infected - the upstream dependency was contaminated, making OpenClaw users the victims, through no fault of their own.
Attack Method: Professional, Precise, and Anti-Detection
This poisoning was not a common "malicious package upload". The attackers demonstrated a high level of adversarial awareness, and the entire attack chain was extremely precisely designed.
Attack Timeline
The entire attack took only about 19 hours from pre-embedding to poisoning.
Three Key Technical Characteristics
1. Ghost Dependency Injection: The source code of Axios itself remained completely unchanged. The attacker only declared an extra dependency, plain-crypto-js, in package.json that was never referenced by the axios code. npm automatically pulls and executes it during installation. This makes source code audits almost unable to find anomalies - if you look at the axios code, there is no problem at all. 2. Decoy Warm-up, Evading "Zero History Account" Detection: 18 hours before releasing the malicious package, the attacker released a clean version in advance to establish a publishing history for the attacker's account. Many automated security tools alert heavily on "new accounts that have never published packages". This warm-up action effectively bypassed this type of detection. 3. Cross-platform RAT + Anti-forensics Self-deletion: The dropper identifies the operating system, deliberately avoids requiring sensitive system modules (such as fs, os, child_process) at the top level of the code, and instead dynamically constructs module names and loads them at runtime. This method can bypass SAST analysis tools.
And then contacts the C2 server http://sfrclak.com:8000/6202033 (IP 142.11.206.73) to download the corresponding platform's second-stage payload:
After execution, the malicious script deletes itself and replaces package.json with a clean version, making post-incident forensics extremely difficult.
Yesterday Morning at 11:19, We Already Detected It
About 41 minutes before npm officially took down the malicious packages at 12:00 Beijing time, the supply chain intelligence module of the SecXin Advanced Persistent Threat Intelligence Platform completed the intelligence collection and threat labeling of this poisoning incident. Detection Time: 11:19 AM today (Beijing time)
This relies on the joint work of the platform's built-in three-layer detection engine:
Multi-source External Intelligence Aggregation
Real-time integration with 24+ external intelligence sources (Snyk, OSV, GitHub Advisory, Socket.dev, etc.) to synchronize new threat package records around the clock without manual trigger
In-house Dynamic and Static Analysis
Multi-tool combination detection + LLM deep semantic analysis on suspicious packages, covering obfuscated code, postinstall hooks, dynamic module loading, and other adversarial technologies
Threat Intelligence and IOC Association
Complete presentation of the attack chain from malicious packages to C2 domains and attack IPs - a single details page to see the complete path from package to C2 of this poisoning
This Axios poisoning incident, from external intelligence discovery to platform collection, was completed entirely by automated processes, with no reliance on manual perception along the decision-making chain.
Self-check Method: First, figure out today's losses. If your team ran npm install or npm update during today's infection window (08:00–12:00 Beijing time), please perform a self-check immediately following the steps below. 4.1 Check Dependency Version
4.2 Check Ghost Dependency Directory (Most Critical Characteristic)
Even if the malicious script has deleted itself, as long as this directory exists, it can be determined that the dropper was executed. 4.3 Check Platform-Specific File Residuals
4.4 Check Network Side Traces
Search for HTTP POST requests to sfrclak.com:8000 in firewalls/traffic logs. If there is a callback, the system is compromised, enter emergency response immediately. Block the following IOCs:
Domains: sfrclak.com / callnrwise.com
IPs: 142.11.206.73 / 142.11.196.73 / 142.11.199.73
Port: 8000
4.5 Immediate Fix: Pin Secure Version
Why "Self-check Checklists" are Not Enough. The self-check steps above can help you stop the bleeding. But every time a similar incident occurs, you need to pull out this checklist again, push it to the development team, wait for them to investigate one by one - and then collect scattered feedback, and then judge if there are any omissions. This process itself is the problem.
Within how many minutes can you know you are infected?
Can you block the malicious package before it is imported?
These two questions are the core of software supply chain defense. What this incident exposed today is precisely the structural blind spot of most corporate software supply chain defenses: threat intelligence perception is passive, defense is after-the-fact, and dependency import on the development side is almost uncontrolled. The chief maintainer of Axios stated publicly on GitHub that he could not revoke the attacker's publishing permissions from within, and could only apply for manual intervention. This means: even for one of the most high-frequency open-source projects in the world, its security relies on the password strength of an account and whether a maintainer has enabled MFA. The trust model of the open-source ecosystem is inherently fragile. Similar supply chain poisoning incidents will not decrease in the future; they will be more frequent, methods will be more precise, and the scope of impact will be wider. Enterprises cannot place trust decisions on the account security of upstream maintainers. A trust validation system that is quantifiable, automated, and independent of manual perception is the long-term solution to deal with this type of systemic risk. Since 11:19 yesterday, this has no longer been just "the security team's business".
IOC Summary: Block the following indicators immediately in firewalls, SIEM, and DNS filtering
