Linux process chain for Axios NPM compromise: curl download with nohup and python3

Flags Linux executions where curl downloads /tmp/ld.py and the payload is run via nohup python3 from an Axios-related node process.

FreeReviewedSigma · High · v5

Product: linux
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-04-01
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → C2

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
- T1059.004Unix Shell
- T1059.006Python
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule identifies a Linux execution chain consistent with a compromised dependency used by the Axios npm package, starting from a Node/Bun process that runs curl to fetch a payload, then launches it detached via nohup and executes it with python3. It further matches a curl process attempting to retrieve content from a specific hard-coded HTTP endpoint. The behavior matters because it reflects post-install style payload delivery and execution, and the rule relies on process creation telemetry including parent image, command line arguments, and executed binary paths.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup

Suspicious Child Process Spawned by Python Interpreter via Process Creation

Malicious Remote Script Piped Directly to a Shell (via process_creation)

HamsaUpdate Linux Payload Download via Wget Piped to Bash (via process_creation)

Malicious TeamPCP durabletask Payload python3 managed.pyz from tmp (via process_creation)

Malicious Curl to Shell Dropper from Paste Site via Command Line

Malicious kagent RAT Delivery via HuggingFace Space Download (via process_creation)

Suspicious Remote Script Execution via curl Piped to bash with nohup on macOS (via process_creation)

Suspicious Botnet Payload Drop to Hidden Xdiag Temp Path

Linux process chain for Axios NPM compromise: curl download with nohup and python3

Pivot detection · T1059.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-axios-npm-plain-crypto-js-compromise-chain-via-curl-nohup-and-python3-0a23a62d

title: "Linux process chain for Axios NPM compromise: curl download with nohup and python3"
id: a86baa52-e4f7-4761-b9eb-71dab38c768f
status: experimental
description: This rule identifies a Linux execution chain consistent with a compromised dependency used by the Axios npm package, starting from a Node/Bun process that runs curl to fetch a payload, then launches it detached via nohup and executes it with python3. It further matches a curl process attempting to retrieve content from a specific hard-coded HTTP endpoint. The behavior matters because it reflects post-install style payload delivery and execution, and the rule relies on process creation telemetry including parent image, command line arguments, and executed binary paths.
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_lnx_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.command-and-control
  - attack.t1059.006
  - attack.t1059.004
  - attack.t1105
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection_node_shell:
    ParentImage|endswith:
      - /node
      - /bun
    CommandLine|contains|all:
      - "curl "
      - /tmp/ld.py
      - "python3 "
      - "nohup "
      - "6202033"
  selection_curl_download:
    Image|endswith: /curl
    CommandLine|contains: http://sfrclak.com
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0a23a62d-c5b3-468b-a072-25064a9a8c87
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL