npm Supply Chain Attack: North Korean Campaign Targeting Axios Users — Detection and Mitigation | Security Arsenal

Introduction

AWS has publicly attributed a wave of malicious package uploads to the npm registry to a North Korean state-sponsored threat actor. This campaign aggressively targets the ecosystem surrounding the ubiquitous axios HTTP client library. By utilizing typosquatting and dependency confusion techniques, the actor aims to poison the software supply chain, compromising developer workstations and CI/CD pipelines. This is not a theoretical risk; active exploitation is occurring, and the immediate priority for defenders is to identify the execution of malicious post-install scripts within their build and runtime environments.

Technical Analysis

Attack Vector

The primary vector of compromise in this campaign is the publication of malicious packages to the public npm registry. These packages are designed to appear as legitimate dependencies for axios or related plugins. Common tactics include:

Typosquatting: Creating packages with names that are one character off or transposed (e.g., axios-hooks vs axio-hooks).
Dependency Confusion: Publishing malicious packages with higher version numbers than internal private packages.

Mechanism of Action

Upon installation via npm install, the malicious package executes a lifecycle script defined in its package. file. The attackers specifically utilize the preinstall, install, or postinstall fields to trigger system-level commands.

Platform: Node.js environments (Windows, Linux, macOS).
Payload Execution: The scripts typically invoke native shells (PowerShell on Windows, Bash/sh on Linux/macOS) to download and execute additional payloads or to exfiltrate sensitive data.
Objective: Credential theft (often targeting .env files or cloud provider keys) and establishing persistence within the development infrastructure.

Exploitation Status

AWS reports confirm that these packages are currently live in the registry and have been downloaded. The campaign represents an active, ongoing supply chain threat.

Detection & Response

SIGMA Rules

YAML

---
title: Suspicious Shell Spawn via npm Process
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects npm or node spawning a shell (PowerShell, Bash, cmd), which is a common behavior in malicious package post-install scripts.
references:
  - https://attack.mitre.org/techniques/T1195/
  - https://nodejs.org/api/packages.html#scripts
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195
  - attack.execution
  - attack.t1059.001
  - attack.t1059.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\npm.exe'
      - '\node.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts that require shell automation (rare in production)
level: high
---
title: Suspicious Shell Spawn via npm Process (Linux/Mac)
id: 9c4b3d2e-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects npm or node spawning a shell (bash, sh, zsh) on Unix-based systems.
references:
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/npm'
      - '/node'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  condition: selection
falsepositives:
  - Legitimate build scripts requiring shell automation
level: high

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for npm or node processes spawning shells or network tools
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("npm.exe", "node.exe", "npm", "node")
| where ProcessFileName in ("powershell.exe", "cmd.exe", "pwsh.exe", "bash", "sh", "curl", "wget")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for child processes of npm that are shells or network utilities
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.CommandLine AS ParentCommand
FROM pslist()
WHERE Parent.Name =~ "npm" OR Parent.Name =~ "node"
  AND Name =~ "powershell|cmd|bash|sh|curl|wget"

Remediation Script

Bash / Shell

#!/bin/bash
# Audit script to check for packages with suspicious install scripts in node_modules
# Usage: ./audit_npm.sh /path/to/project

PROJECT_DIR=${1:-.}

if [ ! -d "$PROJECT_DIR/node_modules" ]; then
  echo "No node_modules directory found in $PROJECT_DIR"
  exit 1
fi
echo "Auditing $PROJECT_DIR for suspicious install scripts..."

# Find all package. files in node_modules and check for install/preinstall/postinstall scripts
grep -r ""\(install\|preinstall\|postinstall\)"

npm Supply Chain Attack: North Korean Campaign Targeting Axios Users — Detection and Mitigation