# North Korea (UNC1069) Supply Chain Compromise of Axios NPM Package via Backdoored plain-crypto-js Dependency

> North Korean threat actor UNC1069 (BlueNoroff-linked) compromised the npm credentials of the Axios lead maintainer and published backdoored versions axios@1.14.1 and axios@0.30.4 containing a malicious dependency (plain-crypto-js@4.2.1) that deploys a cross-platform RAT targeting macOS, Windows, and Linux. With ~100 million weekly downloads and presence in ~80% of cloud environments, the 3-hour exposure window resulted in 135+ endpoint infections and a 3% observed execution rate.

- **Published:** 2026-03-31T12:00:00Z
- **Last reviewed:** 2026-03-31T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0305
- **ID:** TL-2026-0305
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 31, 2026, a supply chain attack compromised the widely-used Axios HTTP client library for Node.js. The attack was attributed to UNC1069, a North Korea-nexus threat actor linked to BlueNoroff operations, by Google Threat Intelligence Group.

The attacker compromised the npm account of jasonsaayman, the lead maintainer of Axios, changing the account email to ifstap@proton.me. Despite the maintainer having 2FA/MFA enabled, the attacker was able to publish directly via npm CLI using a long-lived NPM_TOKEN, bypassing GitHub Actions OIDC-based CI/CD protections. A critical npm platform misconfiguration was identified: even with OIDC Trusted Publishing enabled, npm prioritized legacy NPM_TOKEN environment variables when both authentication methods were present.

The attack was staged in phases. Approximately 18 hours before the main payload delivery, a clean version of plain-crypto-js@4.2.0 was published to establish registry history and avoid novelty-based scanning detection. Then at 23:59:12 UTC on March 30, plain-crypto-js@4.2.1 was published via a throwaway ProtonMail account, containing the actual malicious postinstall hook.

At 00:21:58 UTC on March 31, axios@1.14.1 was published with plain-crypto-js@4.2.1 added as a dependency and tagged as latest. At 01:00:57 UTC, axios@0.30.4 was published targeting the legacy version line. Both versions were removed from npm by 03:29 UTC, creating a roughly 3-hour exposure window.

The malicious postinstall script (setup.js) employed double obfuscation: reversed Base64 encoding with padding character substitution, followed by XOR cipher using the key OrDeR_7077 with constant value 333. Upon execution, the dropper downloaded platform-specific payloads from the C2 server at sfrclak.com:8000 via campaign path /6202033, then self-cleaned by deleting setup.js and restoring the legitimate package.json.

The macOS payload was a C++ compiled Mach-O universal binary deployed to /Library/Caches/com.apple.act.mond, spoofing Apple daemon naming conventions. It generated a 16-character unique victim ID, performed system fingerprinting (hostname, username, OS version, boot times, CPU architecture), and supported commands including peinject, runscript, rundir, and kill. It bypassed code signing via codesign --force --deep --sign. The internal project name macWebT directly corresponds to BlueNoroff documented webT module from RustBucket malware campaigns, providing strong attribution evidence.

The Windows payload used a VBScript downloader that copied PowerShell to %PROGRAMDATA%\\wt.exe, masquerading as Windows Terminal. A system.bat script established persistence via the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key under the name MicrosoftUpdate. A hidden PowerShell RAT with execution policy bypass was deployed.

The Linux payload was a Python RAT downloaded to /tmp/ld.py, launched via nohup python3 as an orphaned background process for command execution and system reconnaissance.

All three variants beaconed to C2 infrastructure every 60 seconds, transmitting system inventory and awaiting commands. The first observed infection occurred just 89 seconds after axios@1.14.1 was published (macOS), with Windows infections observed within 37 minutes.

Additional compromised packages were identified: @qqbrowser/openclaw-qbot@0.0.130 (included tampered axios@1.14.1) and @shadanai/openclaw versions 2026.3.31-1 and 2026.3.31-2 (directly vendored plain-crypto-js). Related C2 infrastructure included callnrwise.com (pivot domain) and calltan.com (pre-existing DPRK infrastructure identified by Volexity researchers).

Socket automated scanner detected the malicious plain-crypto-js@4.2.1 within approximately 6 minutes of publication, demonstrating rapid detection capability. However, the exposure window of approximately 3 hours still resulted in significant impact given Axios massive installation base.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1586 Compromise Accounts

## Sources

- [Google Cloud Threat Intel - North Korea-Nexus Threat Actor Compromises Axios NPM Package](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package/)
- [Snyk - Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT](https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/)
- [Help Net Security - Axios npm packages backdoored in supply chain attack](https://www.helpnetsecurity.com/2026/03/31/axios-npm-backdoored-supply-chain-attack/)
- [Huntress - Supply Chain Compromise of axios npm Package](https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package)
- [The Hacker News - Axios Supply Chain Attack Pushes Cross-Platform RAT](https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html)
- [Wiz - Axios NPM Distribution Compromised in Supply Chain Attack](https://www.wiz.io/blog/axios-npm-compromised-in-supply-chain-attack)
- [GitHub Advisory - GHSA-fw8c-xr5c-95f9](https://github.com/advisories/GHSA-fw8c-xr5c-95f9)
- [OSV - MAL-2026-2306](https://osv.dev/vulnerability/MAL-2026-2306)
- [Snyk Advisory - SNYK-JS-AXIOS-15850650](https://security.snyk.io/vuln/SNYK-JS-AXIOS-15850650)
- [Snyk Advisory - SNYK-JS-PLAINCRYPTOJS-15850652](https://security.snyk.io/vuln/SNYK-JS-PLAINCRYPTOJS-15850652)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0305