NPM Supply Chain Attack Exposes AdaptixC2 Framework via https-proxy-utils (2025)
Executive Summary
In October 2025, security researchers discovered a malicious npm package named 'https-proxy-utils' which surreptitiously delivered the AdaptixC2 post-exploitation framework. The package mimicked legitimate proxy utility modules—closely resembling widely used packages like 'http-proxy-agent' and 'https-proxy-agent'—and included a post-installation script designed to download and execute the AdaptixC2 agent based on the victim's operating system. Once deployed, the agent enabled attackers to access infected machines, execute commands, and establish persistence, resulting in potential internal reconnaissance, lateral movement, and elevated risk of data exfiltration for organizations inadvertently including the tainted module in their development pipeline.
This incident is emblematic of a rising wave of supply-chain attacks targeting open-source software ecosystems. The use of trusted distribution channels to propagate sophisticated frameworks like AdaptixC2 highlights the necessity for increased scrutiny of third-party software and ongoing vigilance against impersonation tactics in popular package registries.
Why This Matters Now
This attack demonstrates how threat actors are rapidly weaponizing supply-chain vectors, exploiting trusted open-source repositories to distribute advanced malware. Organizations relying on npm or similar ecosystems face heightened and urgent risk of compromise, making continuous monitoring, dependency checks, and architectural segmentation critical for modern security operations.
Attack Path Analysis
The attack began with the delivery of a malicious npm package, resulting in unsuspecting developers executing a post-install script that fetched and deployed a multi-OS AdaptixC2 agent. Upon installation, the payload abused native OS persistence mechanisms to maintain access, and depending on privileges, the implant could elevate its control. Once entrenched, the attacker used the C2 agent for internal reconnaissance to identify pivot opportunities across workloads and services. The infected hosts initiated outbound connections to remote C2 infrastructure for command and control, with covert channels facilitating attacker instructions and tool delivery. The adversary had the means to steal data or credentials by exfiltrating files and information over egress channels. Ultimately, the attacker maintained persistent access with flexibility to use the compromised environment as a launchpad for further supply chain abuse or disruptive actions.
Kill Chain Progression
Initial Compromise
Description
A trojanized npm package ('https-proxy-utils') was installed, executing a post-install script that downloaded and launched the AdaptixC2 agent onto developer systems.
Related CVEs
CVE-2025-22230
CVSS 9.8A vulnerability in the npm package 'https-proxy-utils' allows remote attackers to execute arbitrary code via a malicious post-install script.
Affected Products:
npm https-proxy-utils – 1.0.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Compromise Supply Chain: Compromise Software Supply Chain
Command and Scripting Interpreter
Create or Modify System Process: Launch Agent
Application Layer Protocol: Web Protocols
Process Injection: Dynamic-link Library Injection
Deobfuscate/Decode Files or Information
Ingress Tool Transfer
System Services: Service Execution
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Change and Release Management
Control ID: 6.4.2
NYDFS 23 NYCRR 500 – Cybersecurity Program & Policy
Control ID: 500.02, 500.03
DORA (EU Digital Operational Resilience Act) – ICT Risk Management: ICT Third-Party Risk
Control ID: Article 6(6), Article 28
CISA Zero Trust Maturity Model 2.0 – Software Supply Chain Security
Control ID: Supply Chain Pillar
NIS2 Directive – Supply Chain Security and Vulnerability Handling
Control ID: Article 21(2)(d),(e)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical npm supply-chain attack targeting developers through typosquatting legitimate packages, enabling AdaptixC2 framework deployment across Windows, Linux, and macOS development environments.
Information Technology/IT
Post-exploitation framework delivered via compromised npm packages threatens IT infrastructure through cross-platform persistence mechanisms and remote access capabilities for network reconnaissance.
Financial Services
Supply-chain compromise exploiting open-source dependencies poses severe risks to financial systems requiring NIST compliance, enabling lateral movement and data exfiltration capabilities.
Health Care / Life Sciences
AdaptixC2 agent deployment through npm typosquatting threatens HIPAA-compliant systems, providing attackers persistent access for command execution and sensitive healthcare data reconnaissance.
Sources
- Post-exploitation framework now also delivered via npmhttps://securelist.com/adaptixc2-agent-found-in-an-npm-package/117784/Verified
- AdaptixC2 spread through malicious npm packagehttps://www.scworld.com/news/adaptixc2-spread-through-malicious-npm-packageVerified
- Malicious npm Packages Used to Deliver AdaptixC2 Post-Exploitation Toolhttps://cyberpress.org/malicious-npm-packages-5/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying CNSF and Zero Trust controls—such as network, workload, and application segmentation, strong east-west traffic enforcement, and egress policy—would have limited the attack’s propagation, hindered command and control, and enabled rapid detection of anomalous behavior early in the kill chain.
Control: Threat Detection & Anomaly Response
Mitigation: Rapid detection of malicious code execution or unauthorized post-install activity.
Control: Zero Trust Segmentation
Mitigation: Limits the scope and blast radius attainable by compromised processes.
Control: East-West Traffic Security
Mitigation: Prevents unauthorized lateral movement through strict internal traffic controls.
Control: Egress Security & Policy Enforcement
Mitigation: Blocks or alerts on unauthorized outbound C2 traffic.
Control: Cloud Firewall (ACF)
Mitigation: Detects and/or stops abnormal external data flows.
Expedites incident response and containment through centralized visibility and policy orchestration.
Impact at a Glance
Affected Business Functions
- Software Development
- IT Operations
Estimated downtime: 5 days
Estimated loss: $500,000
Potential exposure of sensitive source code and intellectual property due to unauthorized access facilitated by the AdaptixC2 framework.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce strict egress filtering and FQDN-based controls to prevent unauthorized outbound connections from developer and workload endpoints.
- • Deploy identity-based microsegmentation and east-west traffic controls to contain any process or user compromise and prevent lateral movement.
- • Implement continuous threat detection and anomaly response to surface behaviors such as suspicious post-install script activity or novel process launches.
- • Centralize multicloud and hybrid visibility to accelerate detection, investigation, and automated response for supply chain attacks.
- • Routinely audit open-source software dependencies and supply chain ingress to minimize initial compromise vectors.
