Check Axios Malware

Scan the local machine for indicators of compromise from the malicious axios supply-chain attack (March 2026).

When to Use

✅ USE this skill when:

• "是否中了恶意axios" / "npm supply-chain attack check"
• "check if plain-crypto-js is installed"
• "OpenClaw 2026.3.28 安全排查"
• "本机是否被供应链攻击感染"

❌ DON'T use this skill when:

• Remote host scanning → use nmap / nuclei
• Static code analysis → use semgrep
• Binary malware analysis → use VirusTotal

Background

In March 2026, axios versions 1.14.1 and 0.30.4 were trojaned via [email protected] as a dependency. The malicious postinstall script delivered a cross-platform backdoor. OpenClaw 2026.3.28 used axios@^1.7.4 in optionalDependencies and was at risk during the attack window.

IOC Summary

Commands

1. Check for plain-crypto-js (primary IOC)

find /home /root /usr/local /tmp -name "plain-crypto-js" -type d 2>/dev/null

Any result = compromised. Stop here and rotate all credentials.

2. Scan all installed axios versions

find / -path "*/node_modules/axios/package.json" 2>/dev/null | \
  xargs -I{} python3 -c "
import json
d = json.load(open('{}'))
v = d.get('version','?')
flag = '❌ MALICIOUS' if v in ['1.14.1','0.30.4'] else '✅ safe'
print(flag, v, '{}')
" 2>/dev/null

3. Check OpenClaw version

python3 -c "import json; d=json.load(open('$HOME/.npm-global/lib/node_modules/openclaw/package.json')); print('openclaw', d['version'])" 2>/dev/null || echo "openclaw not found"

2026.3.28 = at-risk version (check axios version above to confirm).

4. Check for suspicious background processes

ps aux | grep -E "(curl|wget|nc |ncat|bash -i|/tmp/[^ ]+)" | grep -v grep

5. Check established network connections

ss -tnp | grep ESTABLISHED

6. Check for persistence (crontab, rc files)

crontab -l 2>/dev/null
tail -20 ~/.bashrc ~/.profile ~/.zshrc 2>/dev/null

Incident Response

If any IOC is found:

1. Rotate all credentials on this machine (API keys, SSH keys, tokens)
2. Remove the malicious package: rm -rf /path/to/plain-crypto-js
3. Reinstall clean dependencies: rm -rf node_modules && npm install
4. Restart OpenClaw: openclaw daemon restart
5. Review recent outbound connections in system logs

Reference

Advisory: https://www.panewslab.com/zh/articles/019d42da-491d-70b7-b00b-b14e59b97f80