Aikido Security blog
Axios npm compromise by Sapphire Sleet (in "Shai-Hulud was the best thing to happen to supply chain security") · Aug 24, 2026
March 31, 2026: Axios. Sapphire Sleet (North Korea) compromised a maintainer account and published two backdoored versions 39 minutes apart, each injecting a fake dependency that silently downloaded a cross-platform remote access trojan.