macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup

ATT&CK techniques

Initial Access → C2

Recon
Resource Dev
Initial Access
- T1195.002Compromise Software Supply Chain
Execution
- T1059.002AppleScript
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule flags a specific macOS process execution sequence that includes AppleScript execution (via osascript), a curl-based payload download from packages.npm.org, subsequent permission modification and execution, and removal of a referenced temporary path. Attackers can use a compromised npm dependency to trigger this local execution chain to stage and run further tooling. It relies on process creation telemetry and matches on command-line substrings referencing osascript usage, the npm download URL pattern, and the cleanup of a hardcoded /tmp path.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Linux process chain for Axios NPM compromise: curl download with nohup and python3

Malicious Remote Script Piped Directly to a Shell (via process_creation)

HamsaUpdate Linux Payload Download via Wget Piped to Bash (via process_creation)

Malicious Curl to Shell Dropper from Paste Site via Command Line

Malicious kagent RAT Delivery via HuggingFace Space Download (via process_creation)

Suspicious Remote Script Execution via curl Piped to bash with nohup on macOS (via process_creation)

Suspicious Botnet Payload Drop to Hidden Xdiag Temp Path

Suspicious Network Download Spawned by Node.js During Package Install

Malicious Remote Payload Piped to Shell via wget on PAN-OS

macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup

Pivot detection · T1105 · 9 related

Changelog

v5

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-detects-axios-npm-compromise-process-chain-using-osascript-curl-download-a-a09ee860

title: "macOS: Detect Axios malicious npm execution chain using osascript, curl download, and cleanup"
id: 17312bb9-8bc5-4056-a201-1244570b3b2a
status: experimental
description: This rule flags a specific macOS process execution sequence that includes AppleScript execution (via osascript), a curl-based payload download from packages.npm.org, subsequent permission modification and execution, and removal of a referenced temporary path. Attackers can use a compromised npm dependency to trigger this local execution chain to stage and run further tooling. It relies on process creation telemetry and matches on command-line substrings referencing osascript usage, the npm download URL pattern, and the cleanup of a hardcoded /tmp path.
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
references:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/proc_creation_macos_axios_npm_compromise_indicators.yml
date: 2026-04-01
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.command-and-control
  - attack.t1059.002
  - attack.t1059.004
  - attack.t1105
  - detection.emerging-threats
logsource:
  category: process_creation
  product: macos
detection:
  selection_osascript:
    CommandLine|contains|all:
      - "nohup "
      - "osascript "
      - /tmp/6202033
  selection_curl_download:
    CommandLine|contains|all:
      - "curl "
      - packages.npm.org/product
      - /Library/Caches/com.apple.act.mond
  selection_cleanup:
    CommandLine|contains|all:
      - "rm "
      - "-rf "
      - /tmp/6202033
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a09ee860-31b3-4586-8a68-0ebd74ce0e5f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL