Key Facts
- A supply chain attack affecting the NPM (Node Package Manager) package “Axios” (widely used JavaScript HTTP-Client) was made public in end March 2026.
- DCSO’s analysis of the published indicators and email addresses suggests connections to the DRPK linked threat actor “BlueNoroff”, based on overlaps between activities historically attributed to BlueNoroff and the infrastructure identified in this case.
- DCSO did observe overlaps in the threat actor’s techniques and also their financial motivation which indicates a reuse of known TTPs.
This Blog post has been authored by Sebastian Degner
Photo by Florian Krumm on UnsplashIntroduction
Since March 31, 2026, reports about a malicious Node Package Manager (NPM) package affecting the widely used HTTP-Client Axios have been published by various cybersecurity companies. Axios is one of the most used Javascript HTTP-Client libraries. According to Elastic Security Labs the email address of one of the original maintainers was changed to ifstap@proton[.]me indicating that the account has been compromised. The attacker then published version 1.14.1 of the axios package containing a new postinstall function in the “package.json” that silently executes the JavaScript dropper “setup.js” without user interaction in the background during the installation of the package. The change affects Windows, Linux and macOS systems. While other vendors have thoroughly described the functionality of the malware, this blogpost is about pivoting on the attacker infrastructure which eventually led us to an overlap of infrastructure patterns that are associated with BlueNoroff.
Analyzing publicly reported BlueNoroff Infrastructure
The following network indicators have been published by Google Threat Intelligence Group, Elastic Security Labs and Huntress:
142.11.206[.]73
23.254.167[.]216
http://sfrclak[.]com
http://sfrclak[.]com:8000
http://sfrclak[.]com:8000/6202033
ifstap@proton[.]me
nrwise@proton[.]me
Email Addresses
The email addresses that have been used to push the malicious package utilized proton.me as an email provider. We used Proton’s Web Key Directory (WKD) inspect on which date ifstap@proton[.]me and nrwise@proton[.]me were created.
The WKD can be queried with the following command:
gpg --auto-key-locate local,wkd --locate-keys [email protected]
Both outputs show that the email addresses had been created on March 30, 2026, which is only one day prior to the public reporting of the Axios campaign.
IP Addresses
Additionally, we further investigated the IP addresses from the indicator list to check if there are still services running on open ports.
According to passive DNS data, the mentioned C2 domain sfrclak[.]com resolves to the IP 142.11.206[.]73. Based on internet host search engines this IP address had no open ports or services running at the time of writing, this IP address had no open ports or services running. Therefore, we investigated historical data of this host, which indicated that port 8000/TCP had been opened with an HTTP service running on March 31, 2026. This matches the indicators mentioned above.
The same is true for IP address 23.254.167[.]216 which is another publicly mentioned indicator and has also been observed with an open 8000/TCP port. However, this port had been open since January 28, 2026.
Pivoting based on known Indicators
Both IP addresses that we have mentioned above displayed the exact same header and response body indicating that they are running the Node.js Web Application Framework Express. They also expose a so called “weak” ETag W/”16-zUIWjx30dNMOrJoqA1R8JWYnVAw” in their HTTP header.
We pivoted based on the distinctive body hash that was used. This led to the IP address 23.254.203[.]244 previously unknown in this context. This IP address also displays the previously described patterns on port 8000/TCP during overlapping timeframes to the other IP addresses, that we originally started our investigation with. Also, all three IP addresses (the two originally mentioned in the reports and the third one we have identified) are located in the AS54290 belonging to Hostwinds LLC. Notably Hostwinds LLC has a documented history of hosting infrastructure linked to BlueNoroff.
Ties to BlueNoroff
While researching further information on the newly identified IP address 23.254.203[.]244 we have found a blog post authored by the company Field Effect in June 2025. They reported about BlueNoroff deploying an infostealer malware at a Canadian online gambling service and listing this IP as an indicator. Comparing the Field Effect blog post with the Google report mentioned as a starting point of this investigation revealed, that in both cases the actors utilized curl for ingress tool transfer (T1105), abused Apple Script (T1059.002) and the Unix Shell for execution (T1059.004). While all of these techniques are quite common, both reports also underlined the financial motivation of both attacks.
We were able to identify a third presumably malicious host based on our pivot. This host was mentioned in a previous report that connected this IP to the threat actor BlueNoroff. This IP is located in AS54290 belonging to Hostwinds LLC. Notably Hostwinds LLC has a documented history of hosting infrastructure linked to BlueNoroff. Also we see a (not particularly specific) TTP and motivation overlap between activities connected to BlueNoroff and the report that initially sparked our investigation. Future research should further investigate if BlueNoroff is actively working to pursue attacks on the NPM ecosystem and the Javascript software supply chain. It would also be interesting if the configuration of the host that we have identified change between Field Effect’s report and our investigation. A changed configuration would weaken the link we have identified, a stable configuration would strengthen it.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.