العربية

axios-scanner

Check if your computer was affected by the axios npm supply chain attack. One command. No install needed.

Windows

Open PowerShell and paste this:

irm https://raw.githubusercontent.com/SufficientDaikon/axios-scanner/main/get.ps1 | iex
or
Download ZIP & double-click SCAN.bat

Linux / macOS

curl -fsSL https://raw.githubusercontent.com/SufficientDaikon/axios-scanner/main/axios-scanner.sh | bash

What happened?

On March 31, 2026, the npm account of the primary axios maintainer (114M weekly downloads) was hijacked. Two malicious versions were published containing a Remote Access Trojan. The attack was live for ~3 hours before being reverted.

How the attack worked

1
npm install runs normally

Your project pulls the latest axios matching your version range (e.g. ^1.14.0)

2
axios@1.14.1 is compromised

The malicious version adds a hidden dependency: plain-crypto-js

3
Postinstall script executes

plain-crypto-js runs setup.js immediately after install — no user interaction needed

4
RAT is downloaded

The script contacts sfrclak.com:8000 and downloads a backdoor for your OS

5
Attacker has full access

Shell commands, file theft, credential exfiltration. The virus then self-destructs to hide evidence.

What you'll see when it runs

The scanner shows live progress the entire time. You'll always know it's working and how far along it is.

PowerShell
............................................................ : : : HEADS UP: The full scan usually takes 1 - 5 minutes. : : It needs to look through many files on your computer. : : : : The screen will keep updating so you always know : : it's working. Just sit back and wait for the results. : :............................................................: 33% Step 2 of 6: Looking for the malicious dropper package [ ] Searching your files for axios (1,250 files checked, 14s elapsed) [ OK ] Done! Checked 3,847 files, found 2 match(es). (23.1s) [ OK ] Safe: axios 1.7.7 at C:\Users\you\project\node_modules\axios

What the scanner checks

Every axios installation

Finds all copies of axios on your computer and checks if any are the malicious versions (1.14.1 or 0.30.4)

Dropper package

Searches for the malicious "plain-crypto-js" package and suspicious setup.js scripts inside axios folders

Backdoor files

Checks for files the virus drops on your system (wt.exe, 6202033.vbs, 6202033.ps1)

Network connections

Checks if your computer ever contacted the attacker's server (sfrclak.com / 142.11.206.73)

Persistence mechanisms

Checks scheduled tasks, startup programs, and registry for anything the attacker left behind

Project lockfiles

Scans package-lock.json, yarn.lock, and pnpm-lock.yaml for references to compromised versions

If the scanner says COMPROMISED

Disconnect from the internet

Unplug ethernet or turn off Wi-Fi immediately.

Re-run the scanner with --fix

This will automatically remove the malicious files it found.

Change ALL your passwords

Email, GitHub, npm, cloud services, everything. The attacker had full shell access.

Regenerate keys and tokens

SSH keys, API keys, npm tokens, GitHub PATs. Revoke and recreate all of them.

Check your git history

Look for commits you didn't make. Audit recent CI/CD runs for unauthorized deployments.

Indicators of Compromise

# Compromised packages axios@1.14.1 SHA-1: 2553649f2322049666871cea80a5d0d6adc700ca axios@0.30.4 SHA-1: d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 plain-crypto-js@4.2.1 SHA-1: 07d889e2dadce6f3910dcbc253317d28ca61c766 # C2 Infrastructure Domain: sfrclak.com IP: 142.11.206.73 Port: 8000 Path: /6202033 # RAT Artifacts (Windows) %PROGRAMDATA%\wt.exe %TEMP%\6202033.vbs %TEMP%\6202033.ps1