macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup
Flags macOS command-line patterns showing osascript execution plus npm package download and staged file cleanup.
- Product
- macos
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-04-01
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → C2Recon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags a specific macOS process execution sequence that includes AppleScript execution (via osascript), a curl-based payload download from packages.npm.org, subsequent permission modification and execution, and removal of a referenced temporary path. Attackers can use a compromised npm dependency to trigger this local execution chain to stage and run further tooling. It relies on process creation telemetry and matches on command-line substrings referencing osascript usage, the npm download URL pattern, and the cleanup of a hardcoded /tmp path.
Reporting behind it
- stepsecurity.iohttps://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- derp.cahttps://www.derp.ca/research/axios-npm-supply-chain-rat/
- trendmicro.comhttps://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
- elastic.cohttps://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
- virustotal.comhttps://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_macos_axios_npm_compromise_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup"
id: 17312bb9-8bc5-4056-a201-1244570b3b2a
status: experimental
description: This rule flags a specific macOS process execution sequence that includes AppleScript execution (via osascript), a curl-based payload download from packages.npm.org, subsequent permission modification and execution, and removal of a referenced temporary path. Attackers can use a compromised npm dependency to trigger this local execution chain to stage and run further tooling. It relies on process creation telemetry and matches on command-line substrings referencing osascript usage, the npm download URL pattern, and the cleanup of a hardcoded /tmp path.
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
references:
- https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- https://www.derp.ca/research/axios-npm-supply-chain-rat/
- https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
- https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
- https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_macos_axios_npm_compromise_indicators.yml
date: 2026-04-01
tags:
- attack.initial-access
- attack.t1195.002
- attack.execution
- attack.command-and-control
- attack.t1059.002
- attack.t1059.004
- attack.t1105
- detection.emerging-threats
logsource:
category: process_creation
product: macos
detection:
selection_osascript:
CommandLine|contains|all:
- "nohup "
- "osascript "
- /tmp/6202033
selection_curl_download:
CommandLine|contains|all:
- "curl "
- packages.npm.org/product
- /Library/Caches/com.apple.act.mond
selection_cleanup:
CommandLine|contains|all:
- "rm "
- "-rf "
- /tmp/6202033
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: a09ee860-31b3-4586-8a68-0ebd74ce0e5f
type: derived