Thread: Deep analysis of the axios npm supply chain compromise
All 5 payloads downloaded from VT, reversed in an isolated VM. Full report detection rules:
gist.github.com/N3mes1s/0c0f…
What's in the gist (8 files):
1. Verified Threat Intel Report (all hashes VT-confirmed)
2. Full RE of every payload (source code recovered for all 3 RATs)
3. C2 protocol specification (complete JSON schema, state machine)
4. 8 YARA rules (tested, 100% detection)
5. 8 Sigma rules (Win/Mac/Linux)
6. 11 Suricata/Snort IDS rules (including Base64 beacon patterns)
7. Machine-readable IOC bundle (JSON, 14 SHA256 network MITRE)
8. Extension.SubRoutine research (see below)
Novel findings not in any vendor report:
- Extension.SubRoutine.Run2() — the .NET process injection DLL is completely undocumented. Zero results across all public
sources. Custom-built injector, not from any known tool.
- Linux RAT (
ld.py, 0/76 detection) has a bug — peinject command references undefined variable b64_string. Binary injection
crashes on Linux.
- macOS RAT has zero hardcoded IPs/domains. C2 is runtime-only via argv[1]. Compiled with SDK 26.2.0 (latest Xcode). Build
UUID: c848257813983360905d7ad0f7e5e3f5.
- C2 server confirmed as Express.js via URLScan X-Powered-By header.
-
packages.npm.org in the POST body is not an npm URL — it's the National Association of Pastoral Musicians. Designed to look
legit in network logs.
- Hostwinds AS54290 has confirmed Lazarus infrastructure in the same /18 subnet (
Hunt.io research).
- macOS RAT classified as NukeSped by 4 AV engines. JA3 fingerprint 773906b0... mimics Safari 15.5 — nation-state TLS
tradecraft.
- All 3 RATs share identical 4-command protocol: kill, peinject, runscript, rundir with status codes "Wow"/"Zzz".
- Zenbox memory dump (47MB) downloaded and analyzed — 12 PE files extracted. Extension.SubRoutine DLL not recoverable (C2 was
offline during sandbox run).
Setup.js fully deobfuscated — all 18 XOR-encoded strings decoded including full VBScript and AppleScript payloads.
macOS binary reversed with radare2 — main(), Report(), DoWork(), DoActionIjt(), DoActionScpt(), RunProcess() all
reconstructed. Uses fork execv (not system()), CurlGuard RAII pattern, nlohmann/json v3.11.3.