North Korea (UNC1069) Supply Chain Compromise of Axios NPM Package via Backdoored plain-crypto-js Dependency

North Korea (UNC1069) Supply Chain Compromise of Axios NPM (TL-2026-0305), also tracked as GHSA-fw8c-xr5c-95f9, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-03-31. It is attributed to UNC1069 (North Korea) with high confidence, affects axios axios, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-0305

Threat ID
TL-2026-0305
Also known as
GHSA-fw8c-xr5c-95f9, MAL-2026-2306, SNYK-JS-AXIOS-15850650
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-03-31
Last reviewed
2026-03-31
Attribution
UNC1069
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, financial, cryptocurrency, cloud-services, software-development, government
Target regions
Global
Detection rules
9
Indicators of compromise
24

Malware and tooling in North Korea (UNC1069) Supply Chain Compromise of Axios NPM

Malware and tooling: BlueNoroff webT, Custom RAT (macWebT/BlueNoroff webT module)

North Korean threat actor UNC1069 (BlueNoroff-linked) compromised the npm credentials of the Axios lead maintainer and published backdoored versions axios@1.14.1 and axios@0.30.4 containing a malicious dependency (plain-crypto-js@4.2.1) that deploys a cross-platform RAT targeting macOS, Windows, and Linux. With ~100 million weekly downloads and presence in ~80% of cloud environments, the 3-hour exposure window resulted in 135+ endpoint infections and a 3% observed execution rate.

How North Korea (UNC1069) Supply Chain Compromise of Axios NPM works

On March 31, 2026, a supply chain attack compromised the widely-used Axios HTTP client library for Node.js. The attack was attributed to UNC1069, a North Korea-nexus threat actor linked to BlueNoroff operations, by Google Threat Intelligence Group.

The attacker compromised the npm account of jasonsaayman, the lead maintainer of Axios, changing the account email to ifstap@proton.me. Despite the maintainer having 2FA/MFA enabled, the attacker was able to publish directly via npm CLI using a long-lived NPM_TOKEN, bypassing GitHub Actions OIDC-based CI/CD protections. A critical npm platform misconfiguration was identified: even with OIDC Trusted Publishing enabled, npm prioritized legacy NPM_TOKEN environment variables when both authentication methods were present.

The attack was staged in phases. Approximately 18 hours before the main payload delivery, a clean version of plain-crypto-js@4.2.0 was published to establish registry history and avoid novelty-based scanning detection. Then at 23:59:12 UTC on March 30, plain-crypto-js@4.2.1 was published via a throwaway ProtonMail account, containing the actual malicious postinstall hook.

At 00:21:58 UTC on March 31, axios@1.14.1 was published with plain-crypto-js@4.2.1 added as a dependency and tagged as latest. At 01:00:57 UTC, axios@0.30.4 was published targeting the legacy version line. Both versions were removed from npm by 03:29 UTC, creating a roughly 3-hour exposure window.

The malicious postinstall script (setup.js) employed double obfuscation: reversed Base64 encoding with padding character substitution, followed by XOR cipher using the key OrDeR_7077 with constant value 333. Upon execution, the dropper downloaded platform-specific payloads from the C2 server at sfrclak.com:8000 via campaign path /6202033, then self-cleaned by deleting setup.js and restoring the legitimate package.json.

The macOS payload was a C++ compiled Mach-O universal binary deployed to /Library/Caches/com.apple.act.mond, spoofing Apple daemon naming conventions. It generated a 16-character unique victim ID, performed system fingerprinting (hostname, username, OS version, boot times, CPU architecture), and supported commands including peinject, runscript, rundir, and kill. It bypassed code signing via codesign --force --deep --sign. The internal project name macWebT directly corresponds to BlueNoroff documented webT module from RustBucket malware campaigns, providing strong attribution evidence.

The Windows payload used a VBScript downloader that copied PowerShell to %PROGRAMDATA%\\wt.exe, masquerading as Windows Terminal. A system.bat script established persistence via the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key under the name MicrosoftUpdate. A hidden PowerShell RAT with execution policy bypass was deployed.

The Linux payload was a Python RAT downloaded to /tmp/ld.py, launched via nohup python3 as an orphaned background process for command execution and system reconnaissance.

All three variants beaconed to C2 infrastructure every 60 seconds, transmitting system inventory and awaiting commands. The first observed infection occurred just 89 seconds after axios@1.14.1 was published (macOS), with Windows infections observed within 37 minutes.

Additional compromised packages were identified: @qqbrowser/openclaw-qbot@0.0.130 (included tampered axios@1.14.1) and @shadanai/openclaw versions 2026.3.31-1 and 2026.3.31-2 (directly vendored plain-crypto-js). Related C2 infrastructure included callnrwise.com (pivot domain) and calltan.com (pre-existing DPRK infrastructure identified by Volexity researchers).

Socket automated scanner detected the malicious plain-crypto-js@4.2.1 within approximately 6 minutes of publication, demonstrating rapid detection capability. However, the exposure window of approximately 3 hours still resulted in significant impact given Axios massive installation base.

MITRE ATT&CK techniques used in TL-2026-0305

collection

T1005 Data from Local System

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information

discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter

command-and-control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

initial-access

T1195 Supply Chain Compromise

persistence

T1547 Boot or Logon Autostart Execution

defense-impairment

T1553 Subvert Trust Controls

resource-development

T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities

Affected products and versions in North Korea (UNC1069) Supply Chain Compromise of Axios NPM

  • axios — axios
    Vulnerable versions: 1.14.1; 0.30.4
    Fixed in: 1.14.2; 1.14.0; 0.30.3
  • npm — plain-crypto-js
    Vulnerable versions: 4.2.1
  • npm — @qqbrowser/openclaw-qbot
    Vulnerable versions: 0.0.130
  • npm — @shadanai/openclaw
    Vulnerable versions: 2026.3.31-1; 2026.3.31-2

Remediation for North Korea (UNC1069) Supply Chain Compromise of Axios NPM

Patches

  • Upgrade to axios@1.14.2 or later (clean version)
  • Remove plain-crypto-js from all dependency trees
  • Remove @qqbrowser/openclaw-qbot@0.0.130 and @shadanai/openclaw if present

Immediate actions

  • Audit all systems for axios@1.14.1 or axios@0.30.4 in package-lock.json or node_modules
  • Check for plain-crypto-js in dependency tree: npm ls plain-crypto-js
  • Block outbound connections to sfrclak.com, callnrwise.com, calltan.com, and 142.11.206.73
  • Scan endpoints for RAT artifacts: /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\\wt.exe (Windows), /tmp/ld.py (Linux)
  • Check Windows registry for HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MicrosoftUpdate
  • Isolate any systems showing C2 beaconing activity

Workarounds

  • Pin axios to known-clean version (e.g., 1.14.0 or 1.13.x)
  • Use --ignore-scripts flag with npm install as interim measure
  • Monitor network traffic for connections to port 8000 on known C2 infrastructure

Longer-term hardening

  • Enforce npm lockfile integrity via npm ci instead of npm install in CI/CD
  • Use npm ci --ignore-scripts in build pipelines to prevent postinstall execution
  • Implement Software Composition Analysis (SCA) with real-time dependency monitoring
  • Deploy EDR with behavioral detection for postinstall script execution
  • Add plain-crypto-js and compromised package names to organizational blocklists
  • Review and rotate all npm access tokens, enforce short-lived credentials
  • Audit OIDC Trusted Publishing configurations to ensure legacy tokens are revoked

Weaknesses (CWE) in North Korea (UNC1069) Supply Chain Compromise of Axios NPM

CWE-506, CWE-829, CWE-494, CWE-912

Timeline of North Korea (UNC1069) Supply Chain Compromise of Axios NPM

  • Malicious plain-crypto-js@4.2.1 published at 23:59:12 UTC via throwaway ProtonMail account containing postinstall hook dropper
  • Clean version plain-crypto-js@4.2.0 published to npm to establish package registry history (~18 hours before malicious version)
  • GitHub Advisory GHSA-fw8c-xr5c-95f9 and OSV MAL-2026-2306 published; Snyk advisories SNYK-JS-AXIOS-15850650 and SNYK-JS-PLAINCRYPTOJS-15850652 issued
  • Google Cloud Threat Intel, Snyk, Huntress, and Wiz publish coordinated analysis attributing attack to UNC1069 (North Korea-nexus)
  • C2 infrastructure at sfrclak.com went offline approximately 3 hours after initial package publication
  • Both malicious axios versions (1.14.1 and 0.30.4) and plain-crypto-js@4.2.1 removed from npm registry by 03:29 UTC
  • axios@0.30.4 published at 01:00:57 UTC with same malicious dependency, tagged as legacy to target older version line
  • First observed Windows infection at 00:58:05 UTC, approximately 37 minutes after axios@1.14.1 publication
  • First observed macOS infection at 00:23:27 UTC, just 89 seconds after axios@1.14.1 publication
  • axios@1.14.1 published at 00:21:58 UTC with plain-crypto-js@4.2.1 dependency, tagged as latest on npm
  • Socket automated scanner detected malicious plain-crypto-js@4.2.1 at 00:05:41 UTC, approximately 6 minutes after publication
  • As of 2026-05-29, the specific Axios npm compromise is contained: malicious axios@1.14.1/0.30.4 and plain-crypto-js@4.2.1 were pulled within ~3 hrs, C2 sfrclak.com is offline, and clean versions plus a maintainer post-mortem shipped. But UNC1069/BlueNoroff remains a live DPRK actor (164 tracked domains Feb-Apr 2026, 1,700+ malicious packages), so the tooling and playbook persist and could resurge.

Sources cited for North Korea (UNC1069) Supply Chain Compromise of Axios NPM

Threats related to North Korea (UNC1069) Supply Chain Compromise of Axios NPM

Detection coverage for TL-2026-0305

As of 2026-03-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0305 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats