Slow Fog warns devs over malicious axios malware campaign

cryptonews

Mar 31

Slow Fog flags malicious axios releases pulling in plain-crypto-js malware, exposing crypto developers to cross-platform RATs and stolen credentials via npm. Summary Slow Fog flags [email ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Most Discussed

{"basename":"","ssrTDKData":{"titleTemplate":"%s - Tiger Brokers","title":"Tiger Brokers HK | Online Trading in stocks, bonds & ETFS","description":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","keywords":"tiger trading,tiger security,tiger broker hk,tigers co ltd,tiger trade hk,tiger brokers hk,stock broker,securities broker,online brokerage,hong kong broker,hk broker,online stock trading,online trading platform,stock trading platforms,trading application,stock trading,stock trading hong kong,buying stocks in hong kong,tiger brokers","social":{"ogDescription":"Discover Tiger Brokers HK, an online trading platform for stocks&ETFs, options&futures, bonds and crypto. Open an account to enjoy low commission trading today!","ogImage":"https://c1.itigergrowtha.com/portal5/static/media/og-logo.0a0bd8dc.png","ogUrl":"https://www.gotigerhk.com/news/2623538612"},"companyName":"Tiger Brokers"},"pageData":{"isMobile":false,"isTiger":false,"isTTM":true,"region":"HKG","license":"TBHK","edition":"fundamental"},"isCrawlerRequest":true,"__swrFallback__":{"@#url:\"https://stock-news.skytigris.cn/v3/news\",params:#id:\"2623538612\",edition:\"fundamental\",auth_exemption:1,,,undefined,":{"share":"https://ttm.financial/m/news/2623538612?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-03-31 22:30","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2623538612","market":"nz","top_or_hot":-1,"title":"Slow Fog warns devs over malicious axios malware campaign","media":"cryptonews","content":"<div>\n<p>Slow Fog flags malicious axios releases pulling in plain-crypto-js malware, exposing crypto developers to cross-platform RATs and stolen credentials via npm.\n\n\nSummary\n\n\n\nSlow Fog flags [email ...</p>\n\n<a href=\"https://crypto.news/slow-fog-warns-devs-over-malicious-axios-malware-campaign/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Slow Fog warns devs over malicious axios malware campaign</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nSlow Fog warns devs over malicious axios malware campaign\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-03-31 22:30 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/slow-fog-warns-devs-over-malicious-axios-malware-campaign/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>Slow Fog flags malicious axios releases pulling in plain-crypto-js malware, exposing crypto developers to cross-platform RATs and stolen credentials via npm.\n\n\nSummary\n\n\n\nSlow Fog flags [email ...</p>\n\n<a href=\"https://crypto.news/slow-fog-warns-devs-over-malicious-axios-malware-campaign/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"T43.SI","symbol_name":"云能国际股份","start_time":0,"source_url":"https://crypto.news/slow-fog-warns-devs-over-malicious-axios-malware-campaign/","article_id":"2623538612","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/slow-fog-warns-devs-over-malicious-axios-malware-campaign/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2623538612","pubTimestamp":1774967400,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"Slow Fog flags malicious axios releases pulling in plain-crypto-js malware, exposing crypto developers to cross-platform RATs and stolen credentials via npm.Slow Fog flags [emailprotected] and [emailprotected] as malicious after a maintainer account compromise.The injected [emailprotected] package drops a cross-platform remote access trojan via postinstall scripts.Developers using [emailprotected] are urged to rotate credentials and inspect hosts, as npm rolls back axios to 1.14.0.Blockchain security firm Slow Fog has issued an urgent security reminder after newly published [emailprotected] and [emailprotected] releases pulled in a malicious dependency, [emailprotected], turning one of JavaScript’s most widely used HTTP clients into a supply chain weapon against crypto developers. Axios sees more than 80 million weekly downloads on npm, meaning even a short-lived compromise can ripple across wallet backends, trading bots, exchanges and DeFi infrastructure built on Node.js. In its advis","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"T43.SI":"云能国际股份","BK6085":"保健护理产品经销商","BK6515":"技术设备股"},"translate_title":"Slow Fog警告开发人员注意恶意的axios恶意软件活动","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"T43.SI":0.74},"content_text":"Slow Fog flags malicious axios releases pulling in plain-crypto-js malware, exposing crypto developers to cross-platform RATs and stolen credentials via npm.\n\n\nSummary\n\n\n\nSlow Fog flags [email protected] and [email protected] as malicious after a maintainer account compromise.\nThe injected [email protected] package drops a cross-platform remote access trojan via postinstall scripts.\nDevelopers using [email protected] are urged to rotate credentials and inspect hosts, as npm rolls back axios to 1.14.0.\n\n\n\nBlockchain security firm Slow Fog has issued an urgent security reminder after newly published [email protected] and [email protected] releases pulled in a malicious dependency, [email protected], turning one of JavaScript’s most widely used HTTP clients into a supply chain weapon against crypto developers. Axios sees more than 80 million weekly downloads on npm, meaning even a short-lived compromise can ripple across wallet backends, trading bots, exchanges and DeFi infrastructure built on Node.js. In its advisory, Slow Fog warned that “users who installed [email protected] via npm install -g are potentially exposed,” recommending immediate credential rotation and thorough host-side investigation for signs of compromise.\nThe attack hinges on a fake cryptography package, [email protected], which is silently added as a new dependency and used solely to execute an obfuscated postinstall script that drops a cross-platform remote access trojan targeting Windows, macOS and Linux systems. \nSecurity firm StepSecurity explained that “neither malicious version contains a single line of malicious code inside Axios itself,” and that instead “both inject a fake dependency, [email protected], whose only purpose is to run a postinstall script that deploys a cross-platform remote access trojan (RAT).” Socket’s research team noted that the malicious plain-crypto-js package was published just minutes before the compromised axios release, calling it a “coordinated supply chain attack” against the JavaScript ecosystem.\nAxios maintainer account hijacked\nAccording to StepSecurity, the malicious axios releases were pushed using stolen npm credentials belonging to primary maintainer “jasonsaayman,” allowing attackers to bypass the project’s usual GitHub-based release flow. “It’s a live supply chain compromise in [email protected], which newly depends on [email protected]—a package published hours earlier and identified as obfuscated malware that executes shell commands and erases traces,” security engineer Julian Harris wrote on LinkedIn. npm has now removed the malicious versions and reverted the axios resolution back to 1.14.0, but any environment that pulled 1.14.1 or 0.3.4 during the attack window remains at risk until secrets are rotated and systems are rebuilt.\nThe compromise echoes earlier npm incidents that directly targeted crypto users, including a 2025 campaign in which 18 popular packages like chalk and debug silently swapped wallet addresses to steal funds, prompting Ledger CTO Charles Guillemet to warn that “the affected packages have already been downloaded over 1 billion times.” Researchers have also documented npm malware stealing keys from Ethereum, XRP and Solana wallets, and SlowMist has estimated that crypto hacks and frauds — including backdoored packages and AI-assisted supply chain attacks — caused more than $2.3 billion in losses in the first half of 2025 alone. For now, Slow Fog’s advice is blunt: downgrade axios to 1.14.0, audit dependencies for any trace of [email protected] or openclaw, and assume that any credentials touched by those environments are compromised.\nPrevious software supply chain warnings\nIn a previous crypto.news story on JavaScript supply chain attacks, Ledger’s Guillemet warned that compromised npm packages with more than 2 billion weekly downloads posed a systemic risk to dApps and wallets built on Node.js. Another story detailed how North Korea’s Lazarus Group planted malicious npm packages to backdoor developer environments and target Solana and Exodus wallet users. A third crypto.news story on next-generation malware showed how backdoor supply chain attacks via npm and low-cost AI tools helped criminals remotely control over 4,200 developer machines and contributed to billions of dollars in crypto losses.\n\n\n\n\n\n                You might also like:\n            \n\n                U.S. senators push “Mined in America Act” to cut reliance on Chinese miners","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"}}}