GCVE-110-OSM-2026-1162

Legitimate axios npm package compromised via hijacked maintainer account. Malicious versions 1.14.1 and 0.30.4 were published by an attacker who changed the maintainer email to ifstap@proton.me. The compromised package contacts a C2 server and drops platform-specific RAT payloads (macOS, Windows, Linux). After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection. === PAYLOAD: Multi-platform RAT Dropper === C2 URL: http://sfrclak.com:8000/6202033 C2 IP: 142.11.206.73 Behavior: Contacts C2 server and delivers platform-specific second-stage payloads: - macOS: /Library/Caches/com.apple.act.mond - Windows: %PROGRAMDATA%\wt.exe - Linux: /tmp/ld.py After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection. Published via npm CLI bypassing normal CI/CD processes.