North Korea (UNC1069) Supply Chain Compromise of Axios NPM Package via Backdoored plain-crypto-js Dependency — Threadlinqs Intelligence
As of 2026-05-30, North Korea (UNC1069) Supply Chain Compromise of Axios NPM Package via Backdoored plain-crypto-js Dependency is a critical-severity supply chain threat attributed to UNC1069 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0305 · Severity: CRITICAL · CVSS: 9.8 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: UNC1069 · North Korea · FINANCIAL
North Korean threat actor UNC1069 (BlueNoroff-linked) compromised the npm credentials of the Axios lead maintainer and published backdoored versions axios@1.14.1 and axios@0.30.4 containing a
On March 31, 2026, a supply chain attack compromised the widely-used Axios HTTP client library for Node.js. The attack was attributed to UNC1069, a North Korea-nexus threat actor linked to BlueNoroff operations, by Google Threat Intelligence Group.
The attacker compromised the npm account of jasonsaayman, the lead maintainer of Axios, changing the account email to ifstap@proton.me. Despite the maintainer having 2FA/MFA enabled, the attacker was able to publish directly via npm CLI using a long-lived NPM_TOKEN, bypassing GitHub Actions OIDC-based CI/CD protections. A critical npm platform misconfiguration was identified: even with OIDC Trusted Publishing enabled, npm prioritized legacy NPM_TOKEN environment variables when both authentication methods were present.
The attack was staged in phases. Approximately 18 hours before the main payload delivery, a clean version of plain-crypto-js@4.2.0 was published to establish registry history and avoid novelty-based scanning detection. Then at 23:59:12 UTC on March 30, plain-crypto-js@4.2.1 was published via a throwaway ProtonMail account, containing the actual malicious postinstall hook.
At 00:21:58 UTC on March 31, axios@1.14.1 was published with plain-crypto-js@4.2.1 added as a dependency and tagged as latest. At 01:00:57 UTC, axios@0.30.4 was published targeting the legacy version line. Both versions were removed from npm by 03:29 UTC, creating a roughly 3-hour exposure window.
The malicious postinstall script (setup.js) employed double obfuscation: reversed Base64 encoding with padding character substitution, followed by XOR cipher using the key OrDeR_7077 with constant value 333. Upon execution, the dropper downloaded platform-specific payloads from the C2 server at sfrclak.com:8000 via campaign path /6202033, then self-cleaned by deleting setup.js and restoring the legitimate package.json.
The macOS payload was a C++ compiled Mach-O universal binary deployed to /Library/Caches/com.apple.act.mond, spoofing Apple daemon naming conventions. It generated a 16-character unique victim ID, performed system fingerprinting (hostname, username, OS version, boot times, CPU architecture), and supported commands including peinject, runscript, rundir, and kill. It bypassed code signing via codesign --force --deep --sign. The internal project name macWebT directly corresponds to BlueNoroff documented webT module from RustBucket malware campaigns, providing strong attribution evidence.
The Windows payload used a VBScript downloader that copied PowerShell to %PROGRAMDATA%\\wt.exe, masquerading as Windows Terminal. A system.bat script established persistence via the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key under the name MicrosoftUpdate. A hidden PowerShell RAT with execution policy bypass was deployed.
The Linux payload was a Python RAT downloaded to /tmp/ld.py, launched via nohup python3 as an orphaned background process for command execution and system reconnaissance.
All three variants beaconed to C2 infrastructure every 60 seconds, transmitting system inventory and awaiting commands. The first observed infection occurred just 89 seconds after axios@1.14.1 was published (macOS), with Windows infections observed within 37 minutes.
Additional compromised packages were identified: @qqbrowser/openclaw-qbot@0.0.130 (included tampered axios@1.14.1) and @shadanai/openclaw versions 2026.3.31-1 and 2026.3.31-2 (directly vendored plain-crypto-js). Related C2 infrastructure included callnrwise.com (pivot domain) and calltan.com (pre-existing DPRK infrastructure identified by Volexity researchers).
Socket automated scanner detected the malicious plain-crypto-js@4.2.1 within approximately 6 minutes of publication, demonstrating rapid detection capability. However, the exposure window of approximately 3 hours still resulted in significant impact given Axios massive installation base.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-912
Target sectors: technology, financial, cryptocurrency, cloud-services, software-development, government
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1078, T1059, T1059, T1059, T1547, T1027, T1140, T1036, T1553