axious-core

{"modified":"2026-08-18T23:56:13Z","published":"2026-08-18T23:56:13Z","schema_version":"1.7.4","id":"MAL-2026-14162","summary":"Malicious code in axious-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25)\naxious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte arrays are XOR-decoded at runtime with the key 'stf2026' to reconstruct a download URL and shell command. The decoded URL points to github.com/bebraz1/... which is fetched to %TEMP%\\main.exe and spawned detached with stdio ignored and windowsHide. When executed on WSL/Linux (detected by reading /proc/version and WSL environment variables), a second XOR-decoded bridge command is used to launch the downloaded Windows binary from inside the Linux environment via PowerShell/WSL interop. In parallel, sendInstallMetrics POSTs a JSON payload containing the host platform to a bare IPv4 destination assembled from an array literal ('193','70','34','101').join('.') at 193.70.34.101:20099/vote — an install-success beacon to attacker-controlled infrastructure, with the IP hidden via array join to evade static scanners. The combination of an empty library facade, XOR-obfuscated URLs and shell commands, an unverified remote binary drop-and-execute on install, a WSL escape path, and a bare-IP C2 beacon is a supply-chain dropper.\n","affected":[{"package":{"ecosystem":"npm","name":"axious-core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"03932677c22fab9046a2581f609f0ace77920a8bb196edd069d82cfc5cf8a529","tlsh":"c6d13fca1ef59034834bf96884cf9d13b2a6c207320d4a65ff8f42107f5793c85a69e9"}],"package_integrity":[{"filename":"axious-core-1.0.0.tgz","hashes":{"sha1":"80a28ba3601615a0410af129b328c7bc2bdcd0ab","sha512_sri":"sha512-gU8uaQF2aa3nef2lOmB/kMRE9oOaDLm0R5z6wlv97/rygclEXs68R4dwtTgt6GyMX/O537aKy0VVuW2cHY4IXQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/axious-core/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018230","import_time":"2026-08-19T00:21:11.145636263Z","modified_time":"2026-08-18T23:56:13Z","sha256":"da16d1b32b464ea73dcd68b2fbf9f3b80519453c19402d29de3bc86d79bc5d25","source":"amazon-inspector","versions":["1.0.0"]}]}}