AdaptixC2 Emerges in npm Supply-Chain Exploit Against Developers

According to Kaspersky, AdaptixC2 is a post‑exploitation framework unveiled through a supply‑chain attack in the npm ecosystem, distributed via a malicious package masquerading as a proxy utility. The package, named https-proxy-utils, was crafted to deceive developers into installing malware and even cloned functionality from the legitimate proxy-from-env package, which reportedly has about 50 million weekly downloads.

The attackers also styled the malicious package to resemble trusted packages such as http-proxy-agent and https-proxy-agent, enabling typosquatting as a key technique to exploit developers’ trust. Once installed, the post‑install script downloaded and deployed the AdaptixC2 agent tailored to the victim’s operating system, with Windows, macOS and Linux variants described and architecture checks to fetch the correct payload.

The framework purportedly provides remote access, command execution, file and process management, and multiple persistence methods, turning a developer’s machine into a foothold for broader network infiltration. This incident follows a prior wave of npm supply‑chain activity, including a separate attack that infected more than 500 npm packages using similar post‑install techniques.