UNC1069 Compromises Axios NPM Package in Supply Chain Attack Deploying WAVESHAPER.V2 Cross-Platform Backdoor

UNC1069 Compromises Axios NPM Package in Supply Chain Attack (TL-2026-0309), also tracked as Axios NPM Supply Chain Attack, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-04-01. It is attributed to UNC1069 (North Korea) with high confidence, affects axios axios, maps to 19 MITRE ATT&CK techniques (T1027, T1036.005, T1055), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-0309

Threat ID
TL-2026-0309
Also known as
Axios NPM Supply Chain Attack, Operation Axios Compromise
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-04-01
Last reviewed
2026-04-01
Attribution
UNC1069
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, financial, cryptocurrency, software-development, enterprise
Target regions
Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in UNC1069 Compromises Axios NPM Package in Supply Chain Attack

Malware and tooling: SILKBELL, WAVESHAPER, AstrillVPN, WAVESHAPER.V2 JSON-HTTP C2

North Korea-nexus threat actor UNC1069 compromised the widely-used Axios NPM package (183M+ weekly downloads) by hijacking a maintainer account and injecting a malicious dependency 'plain-crypto-js' into versions 1.14.1 and 0.30.4. The obfuscated SILKBELL dropper deploys WAVESHAPER.V2, a cross-platform RAT with C2 beaconing, process injection, and remote command execution capabilities.

How UNC1069 Compromises Axios NPM Package in Supply Chain Attack works

UNC1069, a North Korea-nexus financially-motivated threat actor active since at least 2018, executed one of the most operationally sophisticated supply chain attacks ever documented against the NPM ecosystem. The attack targeted Axios, a top-10 NPM package with over 183 million weekly downloads used across frontend frameworks, backend services, and enterprise applications worldwide.

The attack began on March 31, 2026, when UNC1069 compromised the lead Axios maintainer's NPM account, gaining elevated permissions that exceeded those of project collaborators and preventing immediate access revocation. Using this access, the attacker published two malicious versions — axios@1.14.1 and axios@0.30.4 — that introduced a new dependency called 'plain-crypto-js' containing the malicious payload. Critically, there were zero lines of malicious code inside axios itself, making detection extremely difficult.

The malicious 'plain-crypto-js' package contained SILKBELL, an obfuscated JavaScript dropper (setup.js) triggered via npm's postinstall hook. Upon package installation, npm automatically executed the obfuscated JavaScript code in the background. SILKBELL fetches OS-specific payloads from the C2 infrastructure, deploying platform-appropriate variants of the WAVESHAPER.V2 backdoor. After successful execution, the dropper self-cleans by deleting itself and replacing files with legitimate axios code, leaving minimal forensic traces.

WAVESHAPER.V2 is a cross-platform remote access trojan (RAT) with three platform-specific implementations: a C++ Mach-O binary for macOS, a PowerShell variant for Windows, and a Python variant for Linux. The backdoor communicates with its C2 server at sfrclak[.]com (resolving to 142.11.206.73) using JSON-based HTTP protocol with 60-second polling intervals. The RAT supports four primary commands: 'kill' (self-termination), 'rundir' (directory enumeration), 'runscript' (arbitrary command execution), and 'peinject' (process injection for persistence and evasion).

On macOS, the malware stages its payloads in /Library/Caches/com.apple.act.mond, disguising itself as a legitimate Apple system process. Developer build path artifacts ('Jain_DEV/client_mac/macWebT/macWebT') found in the macOS binary link this attack to BlueNoroff's 'webT' module observed in 2023 RustBucket campaigns, providing strong attribution evidence. The C2 infrastructure was accessed via an AstrillVPN node previously linked to UNC1069 operations.

The attack window lasted approximately 3 hours (00:21 UTC to 03:20 UTC on March 31, 2026) before the malicious packages were detected and removed. Despite the short window, the massive download volume of Axios means potentially thousands of CI/CD pipelines and developer environments were exposed. The attacker used the email address ifstap@proton.me for the malicious package registration.

Google Threat Intelligence Group (GTIG), SentinelOne, and other researchers confirmed attribution to UNC1069, which has historical ties to BlueNoroff and has been involved in cryptocurrency theft operations using social engineering tactics including fake Zoom meetings. This attack represents a significant escalation in capability — moving from targeted social engineering to mass-scale software supply chain compromise.

MITRE ATT&CK techniques used in TL-2026-0309

defense-evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.004 File Deletion; T1078 Valid Accounts

execution

T1059.001 PowerShell; T1059.006 Python; T1059.007 JavaScript; T1204.002 Malicious File

command-and-control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

initial-access

T1195.002 Compromise Software Supply Chain

persistence

T1547 Boot or Logon Autostart Execution

resource-development

T1585.002 Email Accounts; T1587.001 Malware; T1588.002 Tool

Affected products and versions in UNC1069 Compromises Axios NPM Package in Supply Chain Attack

  • axios — axios
    Vulnerable versions: 1.14.1; 0.30.4
    Fixed in: 1.14.0; 0.30.3
  • unknown — plain-crypto-js
    Vulnerable versions: all
    Fixed in: removed from npm

Remediation for UNC1069 Compromises Axios NPM Package in Supply Chain Attack

Patches

  • Downgrade axios to latest verified clean version (1.14.0 or earlier stable release)
  • Remove plain-crypto-js from all dependency trees
  • Regenerate and rotate all credentials on systems that installed compromised versions

Immediate actions

  • Audit all dependency trees for presence of 'plain-crypto-js' package
  • Check for axios versions 1.14.1 or 0.30.4 in node_modules and lock files
  • Block C2 domain sfrclak.com and IP 142.11.206.73 at perimeter firewalls and DNS
  • Search for /Library/Caches/com.apple.act.mond on macOS systems
  • Terminate any suspicious processes communicating with known C2 infrastructure
  • Isolate any systems confirmed to have installed compromised versions

Workarounds

  • Pin axios version explicitly in package.json (e.g., 1.14.0)
  • Use --ignore-scripts flag during npm install to prevent postinstall hook execution
  • Configure npm to require explicit approval for lifecycle scripts

Longer-term hardening

  • Implement NPM package pinning and lock file verification in CI/CD pipelines
  • Deploy software composition analysis (SCA) tools to detect dependency changes
  • Enable npm audit in all build pipelines with fail-on-vulnerability policies
  • Implement runtime application self-protection (RASP) for supply chain integrity
  • Deploy EDR with behavioral detection for postinstall script execution
  • Establish package provenance verification using npm signatures

Weaknesses (CWE) in UNC1069 Compromises Axios NPM Package in Supply Chain Attack

CWE-506, CWE-829, CWE-494, CWE-502

Timeline of UNC1069 Compromises Axios NPM Package in Supply Chain Attack

  • UNC1069 first observed active, conducting financially-motivated cyber operations linked to North Korea
  • BlueNoroff RustBucket campaigns observed using 'webT' module — later linked to WAVESHAPER.V2 build path artifacts
  • Google Threat Intelligence Group (GTIG) publishes initial technical analysis of the supply chain attack
  • Malicious packages detected and removed from NPM registry at approximately 03:20 UTC — approximately 3-hour exposure window
  • Malicious axios versions 1.14.1 and 0.30.4 published to NPM registry at approximately 00:21 UTC, containing plain-crypto-js dependency with SILKBELL dropper
  • UNC1069 compromises lead Axios NPM maintainer account, gaining elevated publishing permissions
  • Multiple security news outlets (TheHackerNews, HelpNetSecurity, SecurityWeek, The Record) publish coverage of the attack and attribution
  • GTIG, SentinelOne, and other researchers formally attribute the attack to UNC1069 based on C2 infrastructure overlap and WAVESHAPER.V2 code similarities to RustBucket campaigns
  • As of 2026-05-29, the specific incident is contained: malicious axios 1.14.1/0.30.4 were pulled from npm within ~3 hours, plain-crypto-js removed, and clean versions (1.14.0/0.30.3) shipped per axios's post-mortem. But DPRK actor UNC1069/Sapphire Sleet and WAVESHAPER.V2 tooling remain active across follow-on supply-chain ops, so the threat persists.

Sources cited for UNC1069 Compromises Axios NPM Package in Supply Chain Attack

Threats related to UNC1069 Compromises Axios NPM Package in Supply Chain Attack

Detection coverage for TL-2026-0309

As of 2026-04-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0309 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats