# SIGS: PoC for Axios NPM package supply chain compromise

**URL:** <https://community.emergingthreats.net/t/sigs-poc-for-axios-npm-package-supply-chain-compromise/3248>\
**Category:** Rule Signatures\
**Tags:** suricata, malware, etopen\
**Created:** [March 31, 2026, 8:17am UTC](https://community.emergingthreats.net/t/sigs-poc-for-axios-npm-package-supply-chain-compromise/3248 "2026-03-31T08:17:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![n0pth](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@n0pth](https://community.emergingthreats.net/u/n0pth)\
**Post date:** [March 31, 2026, 8:17am UTC](https://community.emergingthreats.net/t/sigs-poc-for-axios-npm-package-supply-chain-compromise/3248/1 "2026-03-31T08:17:08Z")

</div>

Signature proposal based on the following research [One of the most popular JavaScript packages on earth Axios has been compromised | OpenSourceMalware](https://opensourcemalware.com/blog/axios-compromised) (disclaimer: i’m not the author).

NOTE: Signature SIDs need proper adjustments.

```auto
alert dns $HOME_NET any -> any any (msg:"ET MALWARE plain-crypto-js RAT C2 Domain in DNS Lookup (sfrclak .com)"; \
    dns.query; bsize:11; \
    content:"sfrclak.com"; nocase; \
    reference:url,opensourcemalware.com/blog/axios-compromised; \
    classtype:trojan-activity; \
    sid:1000000; rev:1; \
    metadata: \
        created_at 2026_03_31, \
        deployment Perimeter, \
        performance_impact Low, \
        confidence High, \
        signature_severity Major;)

alert http $HOME_NET any -> $EXTERNAL_NET 8000 (msg:"ET MALWARE plain-crypto-js RAT C2 Beacon (FirstInfo/BaseInfo)"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.host; content:"sfrclak.com"; \
  http.user_agent; content:"mozilla/4.0 (compatible|3B| msie 8.0|3B| windows nt 5.1|3B| trident/4.0)"; fast_pattern; \
  http.uri; pcre:"/\/[0-9]+/"; \
  reference:url,opensourcemalware.com/blog/axios-compromised; \
  classtype:trojan-activity; \
  metadata: \
    created_at 2026_03_31, \
    tls_state plaintext, \
    confidence High, \
    deployment Perimeter, \
    signature_severity Major; \
  sid:1000001; rev:1;)

alert http $HOME_NET any -> $EXTERNAL_NET 8000 (msg:"ET MALWARE plain-crypto-js Stage 2 RAT Download"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.user_agent; content:"mozilla/4.0 (compatible|3B| msie 8.0|3B| windows nt 5.1|3B| trident/4.0)"; fast_pattern; \
  http.uri; pcre:"/\/[0-9]+/"; \
  http.request_body; content:"packages.npm.org/product"; \
  reference:url,opensourcemalware.com/blog/axios-compromised; \
  classtype:trojan-activity; \
  metadata: \
    created_at 2026_03_31, \
    tls_state plaintext, \
    confidence High, \
    deployment Perimeter, \
    signature_severity Major; \
  sid:1000002; rev:1;)

alert http $HOME_NET any -> [142.11.206.73] 8000 (msg:"ET HUNTING plain-crypto-js RAT C2 IP/User-Agent Match"; \
  flow:established,to_server; \
  http.method; content:"POST"; \
  http.user_agent; content:"mozilla/4.0 (compatible|3B| msie 8.0|3B| windows nt 5.1|3B| trident/4.0)"; fast_pattern; \
  http.uri; pcre:"/\/[0-9]+/"; \
  reference:url,opensourcemalware.com/blog/axios-compromised; \
  classtype:trojan-activity; \
  metadata: \
    created_at 2026_03_31, \
    tls_state plaintext, \
    confidence Medium, \
    deployment Perimeter, \
    signature_severity Major; \
  sid:100003; rev:1;)

```

---

<div class="post-metadata">

**Author:** ![stu4rt](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@stu4rt](https://community.emergingthreats.net/u/stu4rt)\
**Post date:** [March 31, 2026, 3:46pm UTC](https://community.emergingthreats.net/t/sigs-poc-for-axios-npm-package-supply-chain-compromise/3248/2 "2026-03-31T15:46:53Z")

</div>

Hi @n0pth, thanks for sharing. I will take a look and report back once we have the rules ready for release.

---

<div class="post-metadata">

**Author:** ![stu4rt](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@stu4rt](https://community.emergingthreats.net/u/stu4rt)\
**Post date:** [April 1, 2026, 9:26pm UTC](https://community.emergingthreats.net/t/sigs-poc-for-axios-npm-package-supply-chain-compromise/3248/3 "2026-04-01T21:26:14Z")

</div>

Hi @n0pth, the following sigs went out in today’s release. Thanks again!

2068515 - ET MALWARE plain-crypto-js RAT C2 Domain in DNS Lookup (sfrclak .com) (malware.rules)  
2068516 - ET MALWARE plain-crypto-js RAT C2 Domain in DNS Lookup (callnrwise .com) (malware.rules)  
2068517 - ET MALWARE plain-crypto-js RAT C2 Domain in DNS Lookup (hwsrv-1320779.hostwindsdns .com) (malware.rules)

2068518 - ET MALWARE plain-crypto-js RAT Stage 2 C2 Outbound Request (malware.rules)  
2068519 - ET MALWARE plain-crypto-js RAT Stage 1 C2 Outbound Request (malware.rules)

---

<div class="post-metadata">

**Author:** ![n0pth](https://avatars.discourse-cdn.com/v4/letter/n/3ec8ea/32.png) [@n0pth](https://community.emergingthreats.net/u/n0pth)\
**Post date:** [April 1, 2026, 9:47pm UTC](https://community.emergingthreats.net/t/sigs-poc-for-axios-npm-package-supply-chain-compromise/3248/4 "2026-04-01T21:47:19Z")

</div>

Thank you ET Team for your work !