Axios RAT Postmortem: Trend Micro's Full Teardown, SANS IR Checklist, and the OIDC Signal That Exposed the Attacker

Analysis

Trend Micro's Full Axios RAT Teardown: Phantom Dependency, Anti-Forensics, and C2 Infrastructure

Trend Micro's writeup is the most technically complete analysis of the attack so far, covering the XOR obfuscation scheme, the exact self-destruction sequence that swaps in a clean package.json, and the C2 domain registered just 10 hours before the payload went live. If you want one document to share with your security team, this is it.

Datadog's Registry Forensics: How the Missing OIDC trustedPublisher Field Fingerprints the Account Takeover

Datadog found that the npm registry API itself records whether a version was published via GitHub Actions OIDC or a manual token, and the 1.14.1 metadata shows the attacker's ProtonMail address with no OIDC binding. That single API diff is a reusable detection pattern for any package, not just Axios.

Sonatype: Malicious plain-crypto-js Spread Beyond Axios Into OpenClaw Packages

Sonatype flagged the malicious packages within minutes and found the same compromised dependency appearing in several OpenClaw-related packages, showing the attacker's technique was propagating beyond the initial axios vector. The six-minute detection-to-block window is a concrete benchmark for what automated firewall controls can actually achieve.

News

SANS IR Playbook: Exact File Paths, Hashes, and Network Indicators for Axios RAT Response

SANS distills the incident into a practical defender checklist covering artifact locations per OS, credential rotation scope, and CI/CD pipeline investigation steps. The note on TeamPCP as a potential initial access broker selling stolen publishing credentials is worth watching if you maintain open source packages.

Microsoft Attributes Axios Compromise to North Korea's Sapphire Sleet, Details Cross-Platform RAT Architecture

Microsoft Threat Intelligence pins the attack on Sapphire Sleet, a North Korean actor focused on crypto and finance targets, and confirms the same Hostwinds VPS infrastructure the group is known to use. The mitigation guidance on stripping caret and tilde from package.json is the single highest-leverage config change most JS shops can make today.