The Axios npm package (and by extension, the millions of developers and automated CI/CD systems that download it) · 30/03/2026
Researchers at StepSecurity reveal that attackers compromised the Axios npm package by hijacking the lead maintainer's account to publish malicious versions 1.14.1 and 0.30.4. Few days later Google formally attributes the supply chain compromise to a financially motivated North Korean threat activity cluster tracked as UNC1069. [Date Occurred: 30/03/2026; Date Discovered: 30/03/2026]
Axios npm supply chain compromise (malicious versions 1.14.1 and 0.30.4, plain-crypto-js) · 2026-04-01T21:00:00+00:00 (published_time)
On March 31, 2026, two new npm packages for updated versions of Axios, a popular HTTP client for JavaScript that simplifies making HTTP requests to a REST endpoint with over 70 million weekly downloads, were identified as malicious. ... Microsoft Threat Intelligence has attributed this infrastructure and the Axios npm compromise to Sapphire Sleet, a North Korean state actor.
Axios NPM package supply chain attack (plain-crypto-js; versions 1.14.1 and 0.30.4) · 2026-03-31 (datePublished)
GTIG attributes this activity to UNC1069, a financially motivated North Korea-nexus threat actor active since at least 2018, based on the use of WAVESHAPER.V2, an updated version of WAVESHAPER previously used by this threat actor.
Axios npm package compromise (ZshBucket) · April 01, 2026
On March 31, 2026, a threat actor used stolen maintainer credentials to compromise the widely used HTTP client library Axios Node Package Manager (npm) package and deploy platform-specific ZshBucket variants. CrowdStrike Counter Adversary Operations attributes this activity to STARDUST CHOLLIMA with moderate confidence
Feross on TBPN: How North Korea Hijacked Axios · 2026-04-08T21:27:04.927Z
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign · 2026-04-03T18:45:27.060Z
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios. ... Her analysis connects the Node.js maintainer targeting to documented DPRK-nexus threat actors, specifically the group Mandiant tracks as UNC1069 .
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation · 2026-04-11T03:14:22.225Z
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack. ... The incident adds a new dimension to the ongoing supply chain campaign that has already targeted high-impact Node.js maintainers through a social engineering campaign attributed to North Korean actors.
Axios supply chain attack (in "Axios supply chain attack: How AppSec teams should respond") · 2026-04-02T18:05:45.922Z
Reports attribute the compromise to North Korea-linked threat actors, based on threat indicators. That is consistent with prior operations targeting crypto-adjacent organizations and resulting in the large-scale theft of credentials and source code.
Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444 · 2026-04-01T00:00:00.000Z
We're attributing this attack to TA444/BlueNoroff based on multiple converging lines of evidence. TA444/BlueNoroff operates as a financially motivated subgroup of the Lazarus collective under DPRK direction, and they've been running supply chain attacks against the JavaScript and Python ecosystems for years.
Supply Chain Compromise of axios npm Package · 2026-03-31T08:00:00.000Z
While the exact motivation behind the attack remains unclear, multiple lines of evidence now point to North Korean state-sponsored activity.
Tradecraft Tuesday Recap: axios npm Supply Chain Compromise · 2026-04-21T13:00:00.000Z
Various researchers have pointed to links in the attack to DPRK infrastructure, with Google attributing the incident specifically to UNC1069 , a financially motivated North Korean threat actor active since at least 2018.
North Korean "Sapphire Sleet" Axios npm compromise targeting Macs · 2026-04-10T03:00:00+00:00
North Korean state-supported hackers compromised the official Axios package, which has over 100 million weekly downloads.
Red Canary SecOps Weekly Episode 59: axios npm compromise · (no date on page; episode 59)
This latest episode of Red Canary SecOps Weekly features Red Canary experts Tony Lambert and Keith McCammon discussing the recent axios npm package supply chain attack that occurred in March 2026, where North Korean threat actors (UNC1069) compromised a maintainer’s account and published malicious versions of the popular package.