Threat reportSupply ChainTL-2026-0311
Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) — Cross-Platform RAT via Phantom Dependency
Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) (TL-2026-0311), also tracked as Axios npm Hijack, is a critical-severity supply-chain compromise, first published 2026-04-01 and last reviewed 2026-10-16. It is attributed to APT38 (North Korea) with high confidence, affects axios axios, maps to 37 MITRE ATT&CK techniques (T1027, T1036, T1036.003), and is covered by 9 detection rules and 46 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 37MITRE ATT&CK
- Actors
- 2APT38
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 46Indicators of compromise
Key facts for TL-2026-0311
- Threat ID
- TL-2026-0311
- Also known as
- Axios npm Hijack, WAVESHAPER.V2 Campaign
- Severity
- CRITICAL
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- APT38, UNC1069
- Attribution confidence
- HIGH
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, financial, cryptocurrency, software-development, cloud-infrastructure, devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 46
- Updates
- 2026-10-16 · 2 updates · revalidated 2× · latest source
Malware and tooling in Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK)
Malware and tooling: WAVESHAPER, macWebT
How Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) works
On March 31, 2026, North Korean state actor Sapphire Sleet (UNC1069/BlueNoroff) compromised the npm account of Axios maintainer jasonsaayman and published backdoored versions 1.14.1 and 0.30.4 of the Axios HTTP client library (~100M weekly downloads). The malicious versions injected a phantom dependency plain-crypto-js@4.2.1 whose postinstall hook contacted C2 infrastructure at sfrclak.com:8000 to deploy platform-specific RATs targeting Windows, macOS, and Linux systems.
On March 31, 2026, a sophisticated supply chain attack was executed against the Axios npm package, one of the most widely used JavaScript HTTP client libraries with approximately 100 million weekly downloads and presence in roughly 80% of cloud and code environments. The attack was attributed to the North Korean state-sponsored threat actor Sapphire Sleet (also tracked as UNC1069, BlueNoroff, STARDUST CHOLLIMA, Alluring Pisces, CageyChameleon, and CryptoCore) by both Microsoft Threat Intelligence and Google Threat Intelligence Group.
The attack began with the compromise of the npm credentials belonging to jasonsaayman, the lead Axios maintainer. Evidence suggests a long-lived npm access token was stolen rather than credentials being phished, as the maintainer had MFA/2FA enabled. The npm platform prioritized the token over OIDC when both were present, allowing the attacker to bypass multi-factor authentication. The compromised account email was changed to ifstap@proton.me.
Prior to the main attack, the threat actor pre-staged infrastructure by creating the npm account nrwise (nrwise@proton.me) which published plain-crypto-js@4.2.0 as a clean decoy version approximately 18 hours before the attack, followed by the malicious 4.2.1 at 23:59 UTC on March 30. Two trojanized Axios versions were then published: v1.14.1 (tagged latest) at 00:21 UTC and v0.30.4 (tagged legacy) at 01:00 UTC on March 31, 2026.
The malicious Axios versions added plain-crypto-js@^4.2.1 as a dependency — a package never imported anywhere in the Axios source code. Its sole purpose was to execute a postinstall script (setup.js) that acted as a cross-platform RAT dropper. The dropper employed a custom two-layer obfuscation scheme: Layer 1 reversed an encoded string, replaced underscores with base64 padding characters, then decoded the result. Layer 2 applied XOR encryption using the key OrDeR_7077, selecting digits via the formula 7*i*i % 10 and XORing against constant 333. This dual approach obscured 18 critical strings including module names, C2 infrastructure, and shell commands from signature-based detection tools.
Upon execution, setup.js detected the host operating system and delivered platform-specific payloads:
macOS: Downloaded a Mach-O universal binary to /Library/Caches/com.apple.act.mond, masquerading as an Apple system daemon. The binary was launched via nohup osascript and identified itself to C2 with POST body packages.npm.org/product0. The RAT (internally named macWebT, linking to BlueNoroff webT module from RustBucket campaigns) generated a 16-character unique victim ID and fingerprinted the system (hostname, username, macOS version, timezone, CPU type, install date, boot time, running processes, application directories). It supported commands including peinject (binary injection with ad-hoc code signing via codesign --force --deep --sign -), runscript (shell/AppleScript execution), rundir (directory enumeration), and kill (process termination). It beaconed to C2 every 60 seconds using a deceptive User-Agent string mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0).
Windows: Copied PowerShell to %PROGRAMDATA%\wt.exe to impersonate Windows Terminal, then deployed a VBScript launcher (%TEMP%\6202033.vbs) with hidden window style (window style 0) that executed the PowerShell RAT (%TEMP%\6202033.ps1). Persistence was established via the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate. A resilience mechanism via system.bat at %PROGRAMDATA%\system.bat enabled re-download capability. The Windows RAT provided remote shell execution, binary injection, directory browsing, process listing, and system reconnaissance, beaconing C2 every 60 seconds. POST body identifier: packages.npm.org/product1.
Linux: Deployed a Python script to /tmp/ld.py, launched detached via nohup python3. The RAT provided remote shell execution, process management, directory traversal, and system reconnaissance. It also attempted shell profile injection (.bashrc, .zshrc) for persistence. POST body identifier: packages.npm.org/product2.
Post-execution, the dropper performed anti-forensics by deleting setup.js, removing the malicious package.json containing the postinstall hook, and restoring a clean package.json from a package.md backup, making the infected node_modules directory appear benign to inspection.
The malicious versions were live for approximately 2-3 hours (00:21 to ~03:15 UTC on March 31) before detection and removal. Despite this brief window, the first infection was observed just 89 seconds after publication (00:23:27 UTC), and Huntress observed 135+ endpoints contacting C2 across their partner base. Wiz reported a 3% execution rate across affected environments — a significant footprint given the package massive download volume.
Related malicious packages published by the same infrastructure include @shadanai/openclaw (versions 2026.3.28-2, 2026.3.28-3, 2026.3.31-1, 2026.3.31-2) and @qqbrowser/openclaw-qbot (version 0.0.130). Google Threat Intelligence Group identified the second-stage malware as WAVESHAPER.V2, an updated backdoor linked to UNC1069 earlier activity. The C2 domain calltan.com was also linked to prior DPRK binary usage per Volexity researchers.
MITRE ATT&CK techniques used in TL-2026-0311
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal
Defense Evasion
T1036.003 Masquerading; T1070.004 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1564.001 Hide Artifacts; T1620 Reflective Code Loading
exfiltration
T1041 Exfiltration Over C2 Channel
Privilege Escalation
discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
execution
T1059 Command and Scripting Interpreter
Execution
T1059.001 Command and Scripting Interpreter; T1059.002 Command and Scripting Interpreter; T1059.005 Command and Scripting Interpreter; T1059.006 Command and Scripting Interpreter; T1059.007 Command and Scripting Interpreter; T1204.005 User Execution
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
Command and Control
T1071.001 Application Layer Protocol; T1132.001 Data Encoding
Initial Access
T1078 Valid Accounts; T1195.002 Supply Chain Compromise; T1566.002 Phishing
initial-access
credential-access
T1528 Steal Application Access Token; T1555 Credentials from Password Stores
privilege-escalation
T1546 Event Triggered Execution
persistence
T1547 Boot or Logon Autostart Execution
Persistence
T1547.001 Boot or Logon Autostart Execution
defense-impairment
resource-development
Affected products and versions in Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK)
- axios — axios
Vulnerable versions: 1.14.1; 0.30.4
Fixed in: 1.14.2; 0.30.3 - npm — plain-crypto-js
Vulnerable versions: 4.2.1 - npm — @shadanai/openclaw
Vulnerable versions: 2026.3.28-2; 2026.3.28-3; 2026.3.31-1; 2026.3.31-2 - npm — @qqbrowser/openclaw-qbot
Vulnerable versions: 0.0.130
Remediation for Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK)
Patches
- Upgrade to axios@1.14.2 or later (clean release)
- Pin axios version in package.json with exact version (no ^ or ~ prefix)
- Add overrides in package.json to prevent transitive resolution of plain-crypto-js
Immediate actions
- Audit all lockfiles for axios versions 1.14.1 or 0.30.4 and plain-crypto-js references
- Downgrade to safe versions: axios@1.14.0 (latest) or axios@0.30.3 (legacy)
- Delete node_modules/plain-crypto-js from all environments
- Block C2 domain sfrclak.com, callnrwise.com, calltan.com and IP 142.11.206.73 at network perimeter
- Hunt for RAT artifacts: /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\wt.exe (Windows), /tmp/ld.py (Linux)
- Monitor outbound connections to port 8000 and callback URLs
- Assume credential compromise if malicious versions executed — rotate ALL secrets, API keys, npm tokens, SSH keys, cloud credentials immediately
Workarounds
- Run npm ci --ignore-scripts to prevent postinstall hook execution
- Use npm overrides to force safe axios version across all transitive dependencies
- Rebuild affected systems from known-good state if RAT artifacts detected
Longer-term hardening
- Implement npm package pinning and integrity verification in all CI/CD pipelines
- Deploy EDR with behavioral detection for postinstall hook execution monitoring
- Enforce npm install --ignore-scripts in CI/CD and review postinstall hooks manually
- Implement software composition analysis (SCA) tools to detect phantom dependencies
- Add npm audit and lockfile integrity checks to CI/CD gates
- Monitor for shell profile modifications (.bashrc, .zshrc) in developer environments
- Review and rotate all long-lived npm access tokens; prefer short-lived OIDC tokens
Weaknesses (CWE) in Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK)
Timeline of Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK)
Showing the 20 most recent tracked events.
- Legitimate axios 1.14.0 released from GitHub Actions with SLSA provenance; last clean 1.x release before the compromise. The malicious 1.14.1 and 0.30.4 were instead published directly via npm CLI, bypassing CI/CD and provenance.
- Related malicious packages @shadanai/openclaw versions 2026.3.28-2 and 2026.3.28-3 published to npm, indicating pre-staging of infrastructure
- Malicious plain-crypto-js@4.2.1 published at 23:59:12 UTC containing postinstall hook dropper (setup.js) with dual-layer XOR obfuscation
- Clean decoy version plain-crypto-js@4.2.0 published by nrwise@proton.me account approximately 18 hours before the malicious payload, establishing package legitimacy
- Axios maintainer jasonsaayman npm account compromised via stolen long-lived access token; account email changed to ifstap@proton.me
- Mirror package @depup/axios replicates the malicious release about 17 minutes after publication.
- Sophos telemetry observes first malicious activity at 00:45 UTC.
- plain-crypto-js was removed from npm at 03:29 UTC, roughly 14 minutes after the backdoored axios versions themselves were pulled.
- An axios collaborator opened a deprecation PR and contacted npm directly at 01:38 UTC to force removal of the malicious releases, ahead of the eventual takedown.
- Bitdefender Advanced Threat Control (ATC) recorded its first detection of the backdoored axios@1.14.1 at 00:27 UTC, roughly 6 minutes after publication.
- Malicious Axios versions removed from npm registry at approximately 03:15 UTC after ~3 hour exposure window; 135+ endpoints observed contacting C2 per Huntress
- Socket detects trojanized package within 6 minutes of publication; StepSecurity identifies both malicious versions; community disclosure begins
- Backdoored axios@0.30.4 published at 01:00 UTC tagged as legacy, targeting the older Axios branch to maximize coverage
- First infection observed at 00:23:27 UTC — just 89 seconds after malicious version publication; first Windows wt.exe execution at 00:58:05 UTC
- Backdoored axios@1.14.1 published at 00:21:58 UTC tagged as latest, injecting phantom dependency plain-crypto-js@^4.2.1
- Singapore CSA issues advisory AD-2026-002 on the axios supply chain attack.
- Comprehensive technical analyses published by Wiz, Huntress, SANS, Snyk, Socket, and Aikido; Wiz reports 3% execution rate across affected environments
- Microsoft Threat Intelligence attributes attack to Sapphire Sleet (DPRK); Google TIG independently attributes to UNC1069 with WAVESHAPER.V2 backdoor identification
- Reporting updated with Microsoft (Sapphire Sleet) and CrowdStrike (Stardust Chollima, moderate confidence) attributions, all linked to BlueNoroff, alongside Google GTIG's UNC1069.
- As of 2026-05-29, the specific incident is contained: malicious axios 1.14.1/0.30.4 and plain-crypto-js@4.2.1 were pulled from npm within ~3 hours on Mar 31 and clean releases shipped. But attributed actor Sapphire Sleet/UNC1069 stays highly active (164 domains blocked Feb-Apr, 1,700+ malicious packages), so the supply-chain threat persists.
Update history for TL-2026-0311
- 2026-10-16 — Axios npm Supply Chain Attack - WAVESHAPER.V2 Cross-Platform RAT Deployed via Compromised Maintainer Account (UNC1069): What changed No severity, exploitability, or status change. Existing CRITICAL/ACTIVE exploitability stands. The report's status of ACTIVE is not adopted, because it cites no new activity and the existing MONITORING status is retained. New i
- 2026-08-23 — Axios npm Supply Chain Attack: Compromised Maintainer Account Deploys Cross-Platform RAT (Sapphire Sleet/BlueNoroff): What changed Initial-access root cause corrected/clarified: axios's own post-mortem shows the compromise began with a ~2-week social-engineering campaign that delivered RAT malware to maintainer jasonsaayman's personal PC, which was then us
Sources cited for Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK)
- Microsoft: Mitigating the Axios npm supply chain compromise
- Google Cloud: North Korea-Nexus Threat Actor Targets Axios NPM Package
- Wiz: Axios NPM Distribution Compromised in Supply Chain Attack
- Huntress: Supply Chain Compromise of axios npm Package
- Socket: Supply Chain Attack on Axios Pulls Malicious Dependency
- Aikido: axios compromised on npm — maintainer account hijacked, RAT deployed
- SANS: Axios NPM Supply Chain Compromise — Malicious Packages Deliver RAT
- StepSecurity: axios Compromised on npm — Malicious Versions Drop RAT
- Snyk: Axios npm Package Compromised — Supply Chain Attack Delivers Cross-Platform RAT
- The Hacker News: Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account
- CyberScoop: Attack on axios software developer tool threatens widespread compromises
- SOCRadar: Axios npm Hijack 2026 — Everything You Need to Know
Detection coverage for TL-2026-0311
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0311 across Splunk SPL, Microsoft KQL and Sigma, covering 46 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.