Post-exploitation framework now also delivered via npm

In October 2025, Securelist reported that the npm ecosystem contained a malicious package named https-proxy-utils, which was crafted to deliver the AdaptixC2 post-exploitation framework and had been taken down by then. According to the post, the package imitated legitimate proxies-related packages such as http-proxy-agent and https-proxy-agent, and its post-install script downloads and executes a payload containing the AdaptixC2 agent.

The analysis describes OS-specific delivery: on Windows, the agent is dropped as a DLL in C:\Windows\Tasks and loaded via DLL sideloading by duplicating msdtc.exe; on macOS, the payload is saved to Library/LaunchAgents with a postinstall.js that drops a plist for automatic startup; and on Linux, the agent is fetched to /tmp/.fonts-unix with architecture-tailored binaries and execute permissions.

The researchers note that the first version of AdaptixC2 appeared in early 2025 and was observed being used for malicious purposes in spring 2025, with the npm incident illustrating the growing abuse of open-source ecosystems for post-exploitation. Indicators of compromise include several package hashes for the malicious https-proxy-utils package and related network indicators listed in the report.