Axios Attacker Behind Three More Malicious NPM Packages

The report details discovery of three malicious NPM packages (redeem-onchain-sdk, nicegui, period-newline) delivering a cross-platform infostealer tied to the March 2026 Axios compromise: the packages share the XOR key "OrDeR_7077", use multi-layer obfuscation and self-deletion, exfiltrate credentials to C2 at 18.208.244.120:9999 using AES-256-GCM framing, and remained active across April–May 2026; the report includes IOCs, technical analysis, and remediation steps.