Linux process chain for Axios NPM compromise: curl download with nohup and python3
Flags Linux executions where curl downloads /tmp/ld.py and the payload is run via nohup python3 from an Axios-related node process.
- Product
- linux
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-04-01
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies a Linux execution chain consistent with a compromised dependency used by the Axios npm package, starting from a Node/Bun process that runs curl to fetch a payload, then launches it detached via nohup and executes it with python3. It further matches a curl process attempting to retrieve content from a specific hard-coded HTTP endpoint. The behavior matters because it reflects post-install style payload delivery and execution, and the rule relies on process creation telemetry including parent image, command line arguments, and executed binary paths.
Reporting behind it
- stepsecurity.iohttps://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- derp.cahttps://www.derp.ca/research/axios-npm-supply-chain-rat/
- trendmicro.comhttps://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
- elastic.cohttps://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
- virustotal.comhttps://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_lnx_axios_npm_compromise_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux process chain for Axios NPM compromise: curl download with nohup and python3"
id: a86baa52-e4f7-4761-b9eb-71dab38c768f
status: experimental
description: This rule identifies a Linux execution chain consistent with a compromised dependency used by the Axios npm package, starting from a Node/Bun process that runs curl to fetch a payload, then launches it detached via nohup and executes it with python3. It further matches a curl process attempting to retrieve content from a specific hard-coded HTTP endpoint. The behavior matters because it reflects post-install style payload delivery and execution, and the rule relies on process creation telemetry including parent image, command line arguments, and executed binary paths.
references:
- https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- https://www.derp.ca/research/axios-npm-supply-chain-rat/
- https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
- https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
- https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_lnx_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
- attack.initial-access
- attack.t1195.002
- attack.execution
- attack.command-and-control
- attack.t1059.006
- attack.t1059.004
- attack.t1105
- detection.emerging-threats
logsource:
category: process_creation
product: linux
detection:
selection_node_shell:
ParentImage|endswith:
- /node
- /bun
CommandLine|contains|all:
- "curl "
- /tmp/ld.py
- "python3 "
- "nohup "
- "6202033"
selection_curl_download:
Image|endswith: /curl
CommandLine|contains: http://sfrclak.com
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 0a23a62d-c5b3-468b-a072-25064a9a8c87
type: derived