Comment vérifier si votre application est affectée par l'attaque supply chain Axios (et la corriger)

# 1. Vérifier le lockfile
grep -E "1\.14\.1|0\.30\.4" package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null
 
# 2. Vérifier la dépendance malveillante
ls node_modules/plain-crypto-js 2>/dev/null && echo "⚠️ AFFECTÉ!" || echo "✅ Propre"
 
# 3. Vérifier le système (macOS)
ls -la /Library/Caches/com.apple.act.mond 2>/dev/null && echo "⚠️ RAT TROUVÉ!" || echo "✅ Propre"

cat package-lock.json | python3 -c "
import json, sys
data = json.load(sys.stdin)
found = False
for path, info in data.get('packages', {}).items():
    if 'axios' in path and info.get('version') in ['1.14.1', '0.30.4']:
        print(f'⚠️  CRITIQUE: {path} → {info[\"version\"]}')
        found = True
    if 'plain-crypto-js' in path:
        print(f'⚠️  CRITIQUE: Package malveillant à {path}')
        found = True
if not found:
    print('✅ Aucune version compromise trouvée')
"

grep -A 2 'axios@' yarn.lock | grep -E 'version "1\.14\.1"|version "0\.30\.4"'
grep 'plain-crypto-js' yarn.lock

node -e "try { console.log('Version axios:', require('axios/package.json').version) } catch(e) { console.log('axios non installé') }"
find node_modules -name "plain-crypto-js" -type d 2>/dev/null

[ -f "/Library/Caches/com.apple.act.mond" ] && echo "⚠️ RAT trouvé!" || echo "✅ Propre"
[ -f "/Library/LaunchDaemons/com.apple.act.mond.plist" ] && echo "⚠️ Persistance RAT!" || echo "✅ Propre"
lsof -i -P 2>/dev/null | grep -i "sfrclak\|:8000" && echo "⚠️ Connexion C2!" || echo "✅ Pas de connexion C2"

if (Test-Path "$env:PROGRAMDATA\wt.exe") { Write-Host "⚠️ RAT trouvé!" -ForegroundColor Red }
else { Write-Host "✅ Propre" -ForegroundColor Green }

ss -tnp 2>/dev/null | grep -E "sfrclak|:8000" && echo "⚠️ Connexion C2!" || echo "✅ Propre"
crontab -l 2>/dev/null | grep -iE "sfrclak|plain-crypto" && echo "⚠️ Cron suspect!" || echo "✅ Propre"

# Scan seul
curl -fsSL https://noqta.tn/tools/check-axios-attack.sh | bash
 
# Scan et correction automatique
curl -fsSL https://noqta.tn/tools/check-axios-attack.sh | bash -s -- --fix
 
# Projet spécifique
./check-axios-attack.sh --path /votre/projet --verbose
 
# Sortie JSON pour CI/CD
./check-axios-attack.sh --json

rm -rf node_modules/plain-crypto-js
npm install axios@1.14.0 --save
rm -rf node_modules && npm ci

# macOS
sudo rm -f /Library/Caches/com.apple.act.mond
sudo rm -f /Library/LaunchDaemons/com.apple.act.mond.plist

npm audit
npm audit fix

{ "dependencies": { "axios": "1.14.0" } }

save-exact=true
audit=true

npm profile enable-2fa auth-and-writes

name: Supply Chain Check
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm audit --audit-level=critical
      - run: curl -fsSL https://noqta.tn/tools/check-axios-attack.sh | bash --json