Node.js ecosystem maintainers (Socket CEO, Platformatic CTO, Dotenv creator, Node.js Security WG, and others)

Date (as written): 03/04/2026
Year: 2026
Country: Global
Actors (as written): UNC1069 (North Korean state-linked)
Actor pages: UNC1069
Tags (as written): Attack: Malware; Target Class: Information/Communication; Attack Class: Cyber Espionage Cyber Crime; Initial Access: T1566.002 - Phishing: Spearphishing Link

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Node.js ecosystem maintainers (Socket CEO, Platformatic CTO, Dotenv creator, Node.js Security WG, and others) · 03/04/2026

Researchers at Socket discover that UNC1069 replicated its Axios social engineering campaign against top Node.js maintainers, building fake meeting infrastructure over weeks and delivering RAT malware via a fake software update error message. [Date Occurred: Several weeks before 03/04/2026 (ongoing campaign); Date Discovered: 03/04/2026]

https://www.hackmageddon.com/2026/04/24/1-15-april-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/e/2PACX-1vQ2r4m8VwOtuzK2FJuvkcNKKkg6xMvBiZ2EhovYv9UrG3HLCH6yZ9e0udWfTyL8Gkf3-M33jOAfC_rR/pub?gid=1060075184&single=true&output=csv

https://www.securityweek.com/north-korean-hackers-target-high-profile-node-js-maintainers/

Socket.dev blog

Axios compromise social engineering campaign targeting Node.js maintainers and Socket engineers · 2026-04-10T01:27:33.672Z

The Axios compromise, which delivered write access to npm for a package downloaded 100M times per week, was a weeks-long social engineering campaign targeting the highest-trust maintainers in the Node.js ecosystem . Multiple Socket engineers, including our CEO, were among those targeted by this same North Korean campaign.

https://socket.dev/blog/dont-kill-the-goose-that-lays-the-golden-eggs

Suggest a correction on GitHub