T1070.006

Indicator Removal: Timestomp

discovered 2026-06-01

Attacker-added lib/core/eval.js carries a fake 1985 mtime to blend with the copied legitimate axios files.

View on MITRE ATT&CK

Seen in packages

Campaigns