macOS: Axios NPM compromise file creation via curl and node indicators
Alerts on macOS file events matching curl and node staging paths linked to an Axios npm compromise pattern.
- Product
- macos
- Category
- file_event
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-04-01
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags file creation activity on macOS that matches a specific pattern of command execution artifacts: a curl process writing to a cache-like path and a node process creating a transient file. Such behavior can indicate installation-stage activity associated with malicious npm package compromise workflows, where scripts drop or stage additional payloads. It relies on file event telemetry containing the creating process image path suffix and the target filename involved in the writes.
Reporting behind it
- stepsecurity.iohttps://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- derp.cahttps://www.derp.ca/research/axios-npm-supply-chain-rat/
- trendmicro.comhttps://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
- elastic.cohttps://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
- virustotal.comhttps://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/file_event_macos_axios_npm_compromise_indicators.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS: Axios NPM compromise file creation via curl and node indicators"
id: 8997e97f-bee2-4d9a-a031-80baf9bacd9e
status: experimental
description: "This rule flags file creation activity on macOS that matches a specific pattern of command execution artifacts: a curl process writing to a cache-like path and a node process creating a transient file. Such behavior can indicate installation-stage activity associated with malicious npm package compromise workflows, where scripts drop or stage additional payloads. It relies on file event telemetry containing the creating process image path suffix and the target filename involved in the writes."
references:
- https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- https://www.derp.ca/research/axios-npm-supply-chain-rat/
- https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
- https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
- https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Malware/Axios-NPM-Compromise/file_event_macos_axios_npm_compromise_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-01
tags:
- attack.initial-access
- attack.t1195.002
- attack.command-and-control
- attack.t1105
- detection.emerging-threats
logsource:
category: file_event
product: macos
detection:
selection_curl_download:
Image|endswith: /curl
TargetFilename: /Library/Caches/com.apple.act.mond
selection_node_shell:
Image|endswith: /node
TargetFilename: /tmp/6202033
condition: 1 of selection_*
falsepositives:
- Highly unlikely
level: high
license: DRL-1.1
related:
- id: 2db0458c-05c9-4069-a26f-77becd9c8c13
type: derived