axious-corenpm

axious-core has an empty index.js and no declared functionality, but its scripts/postinstall.js runs a full install-time dropper. Four opaque byte arrays are XOR-decoded at runtime with the key 'stf2026' to reconstruct a download URL and shell command. The decoded URL points to github.com/bebraz1/... which is fetched to %TEMP%\main.exe and spawned detached with stdio ignored and windowsHide. When executed on WSL/Linux (detected by reading /proc/version and WSL environment variables), a second XOR-decoded bridge command is used to launch the downloaded Windows binary from inside the Linux environment via PowerShell/WSL interop. In parallel, sendInstallMetrics POSTs a JSON payload containing the host platform to a bare IPv4 destination assembled from an array literal ('193','70','34','101').join('.') at 193.70.34.101:20099/vote — an install-success beacon to attacker-controlled infrastructure, with the IP hidden via array join to evade static scanners. The combination of an empty library facade, XOR-obfuscated URLs and shell commands, an unverified remote binary drop-and-execute on install, a WSL escape path, and a bare-IP C2 beacon is a supply-chain dropper.