Sigma high experimental sigma

Axios NPM Compromise File Creation Indicators - Linux

Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "/curl",
    "TargetFilename": "/tmp/ld.py"
  },
  "condition": "selection"
}

False Positives

⚠ Highly unlikely

Field Validations

Loading…

Comments (0)

Loading comments...