huntrule

Linux: Axios NPM plain-crypto-js compromise chain via curl, nohup, and python3

Flags Linux executions where curl downloads /tmp/ld.py and the payload is run via nohup python3 from an Axios-related node process.

FreeUnreviewedSigmahighv1
title: "Linux: Axios NPM plain-crypto-js compromise chain via curl, nohup, and python3"
id: a86baa52-e4f7-4761-b9eb-71dab38c768f
status: experimental
description: This rule identifies a Linux process execution chain associated with the Axios NPM supply-chain compromise, specifically matching execution patterns that invoke curl to download a payload into /tmp and then run it with python3 under nohup. It also looks for a curl request containing the specific hardcoded C2 host substring tied to the observed malicious package behavior. The detection relies on process creation telemetry with parent/child command lines and executable paths on Linux.
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_lnx_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.command-and-control
  - attack.t1059.006
  - attack.t1059.004
  - attack.t1105
  - detection.emerging-threats
logsource:
  category: process_creation
  product: linux
detection:
  selection_node_shell:
    ParentImage|endswith:
      - /node
      - /bun
    CommandLine|contains|all:
      - "curl "
      - /tmp/ld.py
      - "python3 "
      - "nohup "
      - "6202033"
  selection_curl_download:
    Image|endswith: /curl
    CommandLine|contains: http://sfrclak.com
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0a23a62d-c5b3-468b-a072-25064a9a8c87
    type: derived

What it detects

This rule identifies a Linux process execution chain associated with the Axios NPM supply-chain compromise, specifically matching execution patterns that invoke curl to download a payload into /tmp and then run it with python3 under nohup. It also looks for a curl request containing the specific hardcoded C2 host substring tied to the observed malicious package behavior. The detection relies on process creation telemetry with parent/child command lines and executable paths on Linux.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.