360 Secure SkillHub
360 安全技能中心

Check Axios Malware

核心功能：扫描本机是否存在axios供应链恶意攻击（涉1.14.1/0.30.4版axios及plain-crypto-js@4.2.1）的感染指标，包括可疑文件、进程、网络连接等。典型使用场景：用户咨询npm安全、axios恶意软件排查、本机供应链感染检测或OpenClaw 2026.3.28安全性时调用。通过执行预设命令输出结果，若感染提供处置步骤，不适用于远程扫描、静态代码分析等场景。

tjefferson
tjefferson
热度 41.53
最近更新 2026-05-11 17:38:40
分类：安全依赖：代码执行应用场景：DevOps / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add check-axios-malware
Metadata
name
check-axios-malware
description
Check if the local machine is infected by the malicious axios supply-chain attack (axios 1.14.1/0.30.4 via plain-crypto-js@4.2.1). Use when: user asks about npm security, axios malware, supply-chain infection check, or OpenClaw 2026.3.28 safety. NOT for: remote host scanning, static code analysis.
metadata
{"openclaw":{"emoji":"🔍","requires":{"bins":["find","ps","ss","crontab","python3"]}}}

Check Axios Malware

Scan the local machine for indicators of compromise from the malicious axios supply-chain attack (March 2026).

When to Use

✅ USE this skill when:

  • "是否中了恶意axios" / "npm supply-chain attack check"
  • "check if plain-crypto-js is installed"
  • "OpenClaw 2026.3.28 安全排查"
  • "本机是否被供应链攻击感染"

❌ DON'T use this skill when:

  • Remote host scanning → use nmap / nuclei
  • Static code analysis → use semgrep
  • Binary malware analysis → use VirusTotal

Background

In March 2026, axios versions 1.14.1 and 0.30.4 were trojaned via plain-crypto-js@4.2.1 as a dependency. The malicious postinstall script delivered a cross-platform backdoor. OpenClaw 2026.3.28 used axios@^1.7.4 in optionalDependencies and was at risk during the attack window.

IOC Summary

Indicator Safe Compromised
plain-crypto-js dir absent present = infected
axios version any except 1.14.1 / 0.30.4 1.14.1 or 0.30.4
suspicious process none curl/wget/nc in background

Commands

1. Check for plain-crypto-js (primary IOC)

find /home /root /usr/local /tmp -name "plain-crypto-js" -type d 2>/dev/null

Any result = compromised. Stop here and rotate all credentials.

2. Scan all installed axios versions

find / -path "*/node_modules/axios/package.json" 2>/dev/null | \
  xargs -I{} python3 -c "
import json
d = json.load(open('{}'))
v = d.get('version','?')
flag = '❌ MALICIOUS' if v in ['1.14.1','0.30.4'] else '✅ safe'
print(flag, v, '{}')
" 2>/dev/null

3. Check OpenClaw version

python3 -c "import json; d=json.load(open('$HOME/.npm-global/lib/node_modules/openclaw/package.json')); print('openclaw', d['version'])" 2>/dev/null || echo "openclaw not found"

2026.3.28 = at-risk version (check axios version above to confirm).

4. Check for suspicious background processes

ps aux | grep -E "(curl|wget|nc |ncat|bash -i|/tmp/[^ ]+)" | grep -v grep

5. Check established network connections

ss -tnp | grep ESTABLISHED

6. Check for persistence (crontab, rc files)

crontab -l 2>/dev/null
tail -20 ~/.bashrc ~/.profile ~/.zshrc 2>/dev/null

Incident Response

If any IOC is found:

  1. Rotate all credentials on this machine (API keys, SSH keys, tokens)
  2. Remove the malicious package: rm -rf /path/to/plain-crypto-js
  3. Reinstall clean dependencies: rm -rf node_modules && npm install
  4. Restart OpenClaw: openclaw daemon restart
  5. Review recent outbound connections in system logs

Reference

Advisory: https://www.panewslab.com/zh/articles/019d42da-491d-70b7-b00b-b14e59b97f80