Malicious Package Affecting plain-crypto-js package, versions *

plain-crypto-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and the author of this package.

This package is involved in the compromise of the axios package;

The package executes an obfuscated postinstall script setup.js that establishes communication with an external command-and-control server (sfrclak.com:8000). The RAT checks the operating system and drops platform-specific payloads:

• macOS: Drops a binary to /Library/Caches/com.apple.act.mond.
• Windows: Drops a persistent executable to %PROGRAMDATA%\wt.exe and runs a PowerShell script.
• Linux: Executes a Python script saved to /tmp/ld.py.

After execution, the malware deletes its setup.js script and replaces its own package.json with a clean stub to actively conceal evidence of the attack from post-infection inspection. If you find any of these persistent files or the node_modules/plain-crypto-js directory, you have been compromised and should no longer trust the system to be safe.

• NPM Security Placeholder
• Snyk Blog
• Socket Research