Inside the Axios supply chain compromise - one RAT to rule them all

Elastic Security Labs identified a supply-chain compromise of the widely used axios npm package where a compromised maintainer account published backdoored releases that installed a postinstall dropper (plain-crypto-js) which fetched platform-specific stage-2 RAT implants for macOS, Windows, and Linux; the implants share an identical C2 protocol, command set, beacon cadence, and spoofed user-agent, and the report includes timelines, hashes, C2 infrastructure (sfrclak.com, 142.11.206.73), anti-forensic behavior, and possible attribution to a DPRK-linked cluster.