UNC1069 Compromises Axios NPM Package in Supply Chain Attack Deploying WAVESHAPER.V2 Cross-Platform Backdoor

Key facts

Detection coverage

As of 2026-04-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0309 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WAVESHAPER.V2 Persistence and Staging Artifacts — Post-Exploitation Phase

Detects WAVESHAPER.V2 post-exploitation persistence mechanisms including Windows Registry Run key creation for autostart, creation of masquerading staging directories (com.apple.act.mond pattern), and process injection activity. Also detects self-cleaning behavior where the dropper removes itself after payload deployment.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1547, T1036.005, T1070.004, T1055
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=13 TargetObject="HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*" Details="*\\Temp\\*") OR (EventCode=11 TargetFilename="*com.apple.act.mond*") OR (EventCode=1 Image="*\\powershell.exe" CommandLine="*-WindowStyle Hidden*" CommandLine="*\\Temp\\*") OR (EventCode=23 TargetFilename="*setup.js*" Image="*\\node.exe*")) | eval detection_phase=case(EventCode=13, "registry_persistence", EventCode=11 AND match(TargetFilename, "com.apple.act.mond"), "masquerading_staging", EventCode=1, "hidden_powershell", EventCode=23, "dropper_selfclean") | table _time, Computer, User, EventCode, detection_phase, Image, TargetObject, TargetFilename, CommandLine | sort _time

Microsoft KQL

union DeviceRegistryEvents, DeviceFileEvents, DeviceProcessEvents | where Timestamp > ago(24h) | where (ActionType == "RegistryValueSet" and RegistryKey has "CurrentVersion\\Run" and RegistryValueData has "\\Temp\\") or (ActionType in ("FileCreated", "FileModified") and FolderPath has "com.apple.act.mond") or (FileName =~ "powershell.exe" and ProcessCommandLine has "-WindowStyle Hidden" and ProcessCommandLine has "\\Temp\\") or (ActionType == "FileDeleted" and FileName == "setup.js" and InitiatingProcessFileName =~ "node.exe") | extend DetectionPhase = case(ActionType == "RegistryValueSet", "registry_persistence", FolderPath has "com.apple.act.mond", "masquerading_staging", FileName =~ "powershell.exe", "hidden_powershell", ActionType == "FileDeleted", "dropper_selfclean", "unknown") | project Timestamp, DeviceName, AccountName, ActionType, DetectionPhase, FileName, FolderPath, RegistryKey, ProcessCommandLine | sort by Timestamp asc

Sigma

title: WAVESHAPER.V2 Persistence and Staging Artifacts
id: 3c9e7a2d-1b8f-4d6e-a5c3-8f2e1d0b4a6c
status: experimental
description: Detects WAVESHAPER.V2 RAT post-exploitation persistence mechanisms including Registry Run key creation, masquerading staging directory creation, hidden PowerShell execution from temp directories, and SILKBELL dropper self-cleaning
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
author: Threadlinqs Team
date: 2026/04/01
tags:
    - attack.persistence
    - attack.t1547
    - attack.defense_evasion
    - attack.t1036.005
    - attack.t1070.004
    - attack.t1055
logsource:
    product: windows
    category: process_creation
detection:
    selection_registry:
        EventType: SetValue
        TargetObject|contains: '\\CurrentVersion\\Run\\'
        Details|contains: '\\Temp\\'
    selection_masquerade:
        TargetFilename|contains: 'com.apple.act.mond'
    selection_hidden_ps:
        Image|endswith: '\\powershell.exe'
        CommandLine|contains|all:
            - '-WindowStyle Hidden'
            - '\\Temp\\'
    selection_selfclean:
        Image|endswith: '\\node.exe'
        TargetFilename|endswith: 'setup.js'
    condition: 1 of selection_*
falsepositives:
    - Legitimate software using Registry Run keys for autostart
    - Apple software on Windows creating com.apple cache directories
level: high

Tuning notes: Exclude known legitimate applications that write Run keys from Temp directories. Whitelist Apple iTunes/iCloud cache paths if present in your environment. For the hidden PowerShell detection, add exclusions for your endpoint management tools that may use hidden windows.

• 🔒 SILKBELL Dropper Execution via NPM Lifecycle Hook — Exploitation Phase · unlock with TL Creds
• 🔒 WAVESHAPER.V2 Process Injection and Persistence Mechanisms — Post-Exploitation Phase · unlock with TL Creds
• 🔒 WAVESHAPER.V2 C2 Network Communication and System Discovery — C2 Phase · unlock with TL Creds
• 🔒 SILKBELL Supply Chain Dropper — Obfuscated JavaScript Payload Fetch — Exploitation Phase · unlock with TL Creds
• 🔒 WAVESHAPER.V2 Cross-Platform Persistence and Defense Evasion — Post-Exploitation Phase · unlock with TL Creds
• 🔒 WAVESHAPER.V2 JSON-HTTP C2 Protocol and Ingress Tool Transfer — C2 Phase · unlock with TL Creds
• 🔒 SILKBELL NPM Postinstall Dropper Execution — Exploitation Phase · unlock with TL Creds
• 🔒 WAVESHAPER.V2 C2 Beaconing and RAT Command Execution — C2 Phase · unlock with TL Creds

Indicators of compromise

As of 2026-04-01, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-0309.

Sample indicators (3 of 16)

• IP address: 142.11.206[.]73
• Domain: sfrclak[.]com
• Email address: ifstap[@]proton[.]me

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

Technical analysis

UNC1069, a North Korea-nexus financially-motivated threat actor active since at least 2018, executed one of the most operationally sophisticated supply chain attacks ever documented against the NPM ecosystem. The attack targeted Axios, a top-10 NPM package with over 183 million weekly downloads used across frontend frameworks, backend services, and enterprise applications worldwide.

The attack began on March 31, 2026, when UNC1069 compromised the lead Axios maintainer's NPM account, gaining elevated permissions that exceeded those of project collaborators and preventing immediate access revocation. Using this access, the attacker published two malicious versions — axios@1.14.1 and axios@0.30.4 — that introduced a new dependency called 'plain-crypto-js' containing the malicious payload. Critically, there were zero lines of malicious code inside axios itself, making detection extremely difficult.

The malicious 'plain-crypto-js' package contained SILKBELL, an obfuscated JavaScript dropper (setup.js) triggered via npm's postinstall hook. Upon package installation, npm automatically executed the obfuscated JavaScript code in the background. SILKBELL fetches OS-specific payloads from the C2 infrastructure, deploying platform-appropriate variants of the WAVESHAPER.V2 backdoor. After successful execution, the dropper self-cleans by deleting itself and replacing files with legitimate axios code, leaving minimal forensic traces.

WAVESHAPER.V2 is a cross-platform remote access trojan (RAT) with three platform-specific implementations: a C++ Mach-O binary for macOS, a PowerShell variant for Windows, and a Python variant for Linux. The backdoor communicates with its C2 server at sfrclak[.]com (resolving to 142.11.206.73) using JSON-based HTTP protocol with 60-second polling intervals. The RAT supports four primary commands: 'kill' (self-termination), 'rundir' (directory enumeration), 'runscript' (arbitrary command execution), and 'peinject' (process injection for persistence and evasion).

On macOS, the malware stages its payloads in /Library/Caches/com.apple.act.mond, disguising itself as a legitimate Apple system process. Developer build path artifacts ('Jain_DEV/client_mac/macWebT/macWebT') found in the macOS binary link this attack to BlueNoroff's 'webT' module observed in 2023 RustBucket campaigns, providing strong attribution evidence. The C2 infrastructure was accessed via an AstrillVPN node previously linked to UNC1069 operations.

The attack window lasted approximately 3 hours (00:21 UTC to 03:20 UTC on March 31, 2026) before the malicious packages were detected and removed. Despite the short window, the massive download volume of Axios means potentially thousands of CI/CD pipelines and developer environments were exposed. The attacker used the email address ifstap@proton.me for the malicious package registration.

Google Threat Intelligence Group (GTIG), SentinelOne, and other researchers confirmed attribution to UNC1069, which has historical ties to BlueNoroff and has been involved in cryptocurrency theft operations using social engineering tactics including fake Zoom meetings. This attack represents a significant escalation in capability — moving from targeted social engineering to mass-scale software supply chain compromise.

MITRE ATT&CK techniques by tactic:

defense-evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.004 File Deletion; T1078 Valid Accounts

execution

T1059.001 PowerShell; T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File

command-and-control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

initial-access

T1195.002 Compromise Software Supply Chain

persistence

T1547 Boot or Logon Autostart Execution

resource-development

T1585.002 Email Accounts; T1587.001 Malware; T1588.002 Tool

Remediation

Patches

• Downgrade axios to latest verified clean version (1.14.0 or earlier stable release)
• Remove plain-crypto-js from all dependency trees
• Regenerate and rotate all credentials on systems that installed compromised versions

Immediate actions

• Audit all dependency trees for presence of 'plain-crypto-js' package
• Check for axios versions 1.14.1 or 0.30.4 in node_modules and lock files
• Block C2 domain sfrclak.com and IP 142.11.206.73 at perimeter firewalls and DNS
• Search for /Library/Caches/com.apple.act.mond on macOS systems
• Terminate any suspicious processes communicating with known C2 infrastructure
• Isolate any systems confirmed to have installed compromised versions

Workarounds

• Pin axios version explicitly in package.json (e.g., 1.14.0)
• Use --ignore-scripts flag during npm install to prevent postinstall hook execution
• Configure npm to require explicit approval for lifecycle scripts

Longer-term hardening

• Implement NPM package pinning and lock file verification in CI/CD pipelines
• Deploy software composition analysis (SCA) tools to detect dependency changes
• Enable npm audit in all build pipelines with fail-on-vulnerability policies
• Implement runtime application self-protection (RASP) for supply chain integrity
• Deploy EDR with behavioral detection for postinstall script execution
• Establish package provenance verification using npm signatures

Affected and fixed versions

• axios — axios
  Vulnerable versions: 1.14.1; 0.30.4
  Fixed in: 1.14.0; 0.30.3
• unknown — plain-crypto-js
  Vulnerable versions: all
  Fixed in: removed from npm

Timeline

• 2018-01-01 UNC1069 first observed active, conducting financially-motivated cyber operations linked to North Korea
• 2023-06-01 BlueNoroff RustBucket campaigns observed using 'webT' module — later linked to WAVESHAPER.V2 build path artifacts
• 2026-03-31 Google Threat Intelligence Group (GTIG) publishes initial technical analysis of the supply chain attack
• 2026-03-31 Malicious packages detected and removed from NPM registry at approximately 03:20 UTC — approximately 3-hour exposure window
• 2026-03-31 Malicious axios versions 1.14.1 and 0.30.4 published to NPM registry at approximately 00:21 UTC, containing plain-crypto-js dependency with SILKBELL dropper
• 2026-03-31 UNC1069 compromises lead Axios NPM maintainer account, gaining elevated publishing permissions
• 2026-04-01 Multiple security news outlets (TheHackerNews, HelpNetSecurity, SecurityWeek, The Record) publish coverage of the attack and attribution
• 2026-04-01 GTIG, SentinelOne, and other researchers formally attribute the attack to UNC1069 based on C2 infrastructure overlap and WAVESHAPER.V2 code similarities to RustBucket campaigns
• 2026-05-29 As of 2026-05-29, the specific incident is contained: malicious axios 1.14.1/0.30.4 were pulled from npm within ~3 hours, plain-crypto-js removed, and clean versions (1.14.0/0.30.3) shipped per axios's post-mortem. But DPRK actor UNC1069/Sapphire Sleet and WAVESHAPER.V2 tooling remain active across follow-on supply-chain ops, so the threat persists.

Sources cited

• GTIG: North Korea-Nexus Threat Actor Targets Axios NPM Package Google Cloud · Research · 2026-03-31
• Malpedia: OSX.WAVESHAPER Analysis malpedia.caad.fkie.fraunhofer.de · Research · 2026-03-31
• TheHackerNews: Google Attributes Axios npm Supply Chain Attack to UNC1069 The Hacker News · News · 2026-04-01
• HelpNetSecurity: North Korean Hackers Linked to Axios npm Supply Chain Compromise Help Net Security · News · 2026-04-01
• SecurityWeek: Axios NPM Package Breached in North Korean Supply Chain Attack SecurityWeek · News · 2026-04-01
• The Record: Google Links Axios Supply Chain Attack to North Korean Group The Record · News · 2026-04-01

Related threats

• Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) Reaches OpenAI macOS Signing Pipeline, Forces Apple Certificate Rotation — DPRK UNC1069 / Sapphire Sleet WAVESHAPER.V2
• Axios npm Supply Chain Compromise — WAVESHAPER.V2 Cross-Platform RAT Deployment by UNC1069/Sapphire Sleet (DPRK)
• Axios npm Supply Chain Compromise — Malicious axios@1.14.1 and axios@0.30.4 Inject plain-crypto-js@4.2.1 RAT Dropper
• Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) — Cross-Platform RAT via Phantom Dependency
• North Korea (UNC1069) Supply Chain Compromise of Axios NPM Package via Backdoored plain-crypto-js Dependency

Related coverage of this activity

• Axios maintainer token theft
• Axios transitive dependency RAT
• plain-crypto-js axios backdoor
• STARDUST CHOLLIMA/TeamPCP npm poisoning
• Sapphire Sleet axios maintainer takeover

More from UNC1069

• ClickFix Copy-Paste Terminal Campaigns Targeting macOS and Windows: MacSync Stealer Lures and DPRK UNC1069 Multi-Stage Intrusions (Objective-See: Stopped at ⌘+V)
• Mastra npm Packages Trojanized with Malicious easy-day-js Dependency (UNC1069)
• Malicious open-source packages: axios npm account hijack (plain-crypto-js / WAVESHAPER.V2), tensorflow-opt PyPI miner, and Contagious Interview multi-ecosystem campaign
• Evolution of Web3 in Cloud Supply Chain Attacks: Blockchain Smart-Contract C2 (EtherHiding, TxDataHiding, NullReceiver) in DPRK-Linked npm/Go/Packagist/Rust Campaigns
• Google Cloud Threat Intelligence: Supply Chain Compromise Campaigns and Mitigation Guidance (2025-2026)
• Hackers poison arrayref Rust crate (0.3.10) via proc-macro1 typosquat to push DPRK-linked cross-platform infostealer backdoor at compile time

Previous and next in supply chain

• 36-Month Precision Supply Chain Campaign Targeting DevSecOps Infrastructure (CVE-2024-3094, CVE-2025-30066, CVE-2025-30154) Next report

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages
• TeamPCP Supply Chain Attack on Trivy, LiteLLM