Malicious Transitive Dependency in Axios Affects Millions of Users

This analysis documents a supply-chain attack that injected a malicious npm package (plain-crypto-js) into axios releases, using a postinstall setup.js to deploy multi-platform RATs (Windows PowerShell reflective injection, Linux Python RAT, macOS universal binary), communicate with C2 at sfrclak.com:8000, perform extensive reconnaissance and exfiltration, and use obfuscation and self-deletion to evade analysis; the report provides timeline, IOCs, detection rules (YARA/Snort/OSQuery), and containment and long-term mitigations.