A hacker briefly delivered malware this week through a popular open-source project for software developers that has an estimated 100 million weekly downloads, raising the possibility of compromises spreading widely through a supply-chain attack.<\/p>\n
Axios is a JavaScript client library used in web requests. The unknown attacker hijacked the npm account \u2014 npm being a package manager for JavaScript \u2014 of the lead axios maintainer, and then published malicious versions of axios with remote access trojans to npm. That happened on Sunday night going into Monday morning, cybersecurity firm Huntress<\/a> said, before the poisoned versions were pulled.<\/p>\n Aikido<\/a>, another security firm, called it \u201cone of the most impactful npm supply chain attacks on record.\u201d Researchers at a large number of cyber companies have sounded alarms about the attack, including Step Security<\/a>, Socket<\/a>, Endor Labs<\/a> and others.<\/p>\n According to Step Security, the malicious \u201caxios@1.14.1\u201d and \u201caxios@0.30.4\u201d versions inject a new software dependency, plain-crypto-js@4.2.1, that acts as a loader for the malware. It targets MacOS, Windows and Linux devices.<\/p>\n But, while the researchers describe it as malware, they note that \u201cthere are zero lines of malicious code inside axios itself.\u201d Rather, the software is simply functioning as designed \u2014 or redesigned.<\/p>\n \u201cBoth poisoned releases inject a fake dependency\u2026 never imported anywhere in the axios source, whose sole purpose is to run a [post installation] script that deploys a cross-platform remote access trojan,\u201d wrote Ashish Kurmi, chief technology officer and founder of Step Security.<\/p>\n Feross Aboukhadijeh, CEO and founder of Socket, called the situation \u201ca live compromise\u201d with a wide potential blast radius.<\/p>\n