It’s been revealed that attackers managed to steal a crucial npm access token that belonged to the lead maintainer of axios, the widely used HTTP client library in JavaScript. They exploited this token to release two tainted versions that contain a cross-platform remote access trojan capable of targeting macOS, Windows, and Linux systems. These malicious packages were present on the npm registry for about three hours before they were removed.
Axios, with over 100 million downloads weekly, is a foundational component in about 80% of cloud and code environments, impacting various areas from React front-ends to CI/CD pipelines to serverless functions. The rapid detection by companies like Huntress and Wiz highlights the severity of the situation, with at least 135 systems compromised during this incident.
This incident marks the third significant npm supply chain breach in the past seven months, all of which have exploited maintainer credentials. Despite implementing recommended security measures, Axios fell victim to this attack.
Unauthorized Access and Malicious Code Deployment
The attacker gained control of the npm account belonging to @jasonsaayman, a lead maintainer of axios, by changing the account email and then proceeded to publish the tainted packages through npm‘s CLI, bypassing the project’s GitHub Actions CI/CD pipeline.
Interestingly, the attacker did not tamper with Axios’ source code; instead, they added a new dependency, plain-crypto-js@4.2.1, to both release branches. This dependency, which was not imported anywhere in the codebase, executed a postinstall script that planted the remote access trojan on the developer’s machine.
The meticulous planning involved in this attack is evident as the attacker first published a clean version of plain-crypto-js under a separate npm account to evade detection before releasing the weaponized version. The malware was designed to erase itself after execution and replace the package.json file to hinder forensic analysis.
StepSecurity and Socket were among the first to identify this attack, labeling it as one of the most sophisticated supply chain attacks targeting a top-10 npm package.
Security Measures vs. Exploitation
Axios had implemented various security measures, including using npm‘s OIDC Trusted Publisher mechanism for legitimate releases. However, the attacker found a gap in the system by exploiting the legacy token that was still active alongside OIDC credentials. This allowed the attacker to bypass the newer security protocols.
Despite the security stack appearing robust, the legacy token served as a loophole that the attacker exploited. The maintainer expressed surprise and concern upon discovering the compromise, emphasizing their use of 2FA/MFA on all their accounts.
Endor Labs detailed the disparities between the legitimate and malicious versions of Axios, showcasing the importance of verifying package provenance, a step that could have prevented this attack.
Lessons Learned and Future Precautions
With three supply chain attacks in recent months sharing the same root cause of compromised maintainer credentials, it is evident that credential security remains a critical issue. Despite improvements in npm‘s security protocols post-previous breaches, the reliance on individual maintainer accounts as the primary trust anchor poses a significant risk.
Security leaders are advised to assess the impact of this incident, identify compromised systems, and take necessary actions such as rebuilding affected machines from a secure state and rotating all accessible credentials. Implementing stringent security practices, such as enforcing npm ci --ignore-scripts in CI/CD pipelines, can help mitigate such risks in the future.
While AI tools can aid in identifying potential risks, the human element in maintaining credentials remains a critical factor. Moving forward, a shift towards mandatory provenance attestation and multi-party signing could enhance security measures and reduce the likelihood of similar attacks.
The Axios incident serves as a stark reminder of the persistent threat posed by credential compromises in the software supply chain and the importance of continuous vigilance and proactive security measures.
