Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) — Cross-Platform RAT via Phantom Dependency — Threadlinqs Intelligence
As of 2026-05-30, Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) — Cross-Platform RAT via Phantom Dependency is a critical-severity supply chain threat attributed to APT38 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0311 · Severity: CRITICAL · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: APT38 · North Korea · FINANCIAL
On March 31, 2026, North Korean state actor Sapphire Sleet (UNC1069/BlueNoroff) compromised the npm account of Axios maintainer jasonsaayman and published backdoored versions 1.14.1 and 0.30.4 of the
On March 31, 2026, a sophisticated supply chain attack was executed against the Axios npm package, one of the most widely used JavaScript HTTP client libraries with approximately 100 million weekly downloads and presence in roughly 80% of cloud and code environments. The attack was attributed to the North Korean state-sponsored threat actor Sapphire Sleet (also tracked as UNC1069, BlueNoroff, STARDUST CHOLLIMA, Alluring Pisces, CageyChameleon, and CryptoCore) by both Microsoft Threat Intelligence and Google Threat Intelligence Group.
The attack began with the compromise of the npm credentials belonging to jasonsaayman, the lead Axios maintainer. Evidence suggests a long-lived npm access token was stolen rather than credentials being phished, as the maintainer had MFA/2FA enabled. The npm platform prioritized the token over OIDC when both were present, allowing the attacker to bypass multi-factor authentication. The compromised account email was changed to ifstap@proton.me.
Prior to the main attack, the threat actor pre-staged infrastructure by creating the npm account nrwise (nrwise@proton.me) which published plain-crypto-js@4.2.0 as a clean decoy version approximately 18 hours before the attack, followed by the malicious 4.2.1 at 23:59 UTC on March 30. Two trojanized Axios versions were then published: v1.14.1 (tagged latest) at 00:21 UTC and v0.30.4 (tagged legacy) at 01:00 UTC on March 31, 2026.
The malicious Axios versions added plain-crypto-js@^4.2.1 as a dependency — a package never imported anywhere in the Axios source code. Its sole purpose was to execute a postinstall script (setup.js) that acted as a cross-platform RAT dropper. The dropper employed a custom two-layer obfuscation scheme: Layer 1 reversed an encoded string, replaced underscores with base64 padding characters, then decoded the result. Layer 2 applied XOR encryption using the key OrDeR_7077, selecting digits via the formula 7*i*i % 10 and XORing against constant 333. This dual approach obscured 18 critical strings including module names, C2 infrastructure, and shell commands from signature-based detection tools.
Upon execution, setup.js detected the host operating system and delivered platform-specific payloads:
macOS: Downloaded a Mach-O universal binary to /Library/Caches/com.apple.act.mond, masquerading as an Apple system daemon. The binary was launched via nohup osascript and identified itself to C2 with POST body packages.npm.org/product0. The RAT (internally named macWebT, linking to BlueNoroff webT module from RustBucket campaigns) generated a 16-character unique victim ID and fingerprinted the system (hostname, username, macOS version, timezone, CPU type, install date, boot time, running processes, application directories). It supported commands including peinject (binary injection with ad-hoc code signing via codesign --force --deep --sign -), runscript (shell/AppleScript execution), rundir (directory enumeration), and kill (process termination). It beaconed to C2 every 60 seconds using a deceptive User-Agent string mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0).
Windows: Copied PowerShell to %PROGRAMDATA%\wt.exe to impersonate Windows Terminal, then deployed a VBScript launcher (%TEMP%\6202033.vbs) with hidden window style (window style 0) that executed the PowerShell RAT (%TEMP%\6202033.ps1). Persistence was established via the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate. A resilience mechanism via system.bat at %PROGRAMDATA%\system.bat enabled re-download capability. The Windows RAT provided remote shell execution, binary injection, directory browsing, process listing, and system reconnaissance, beaconing C2 every 60 seconds. POST body identifier: packages.npm.org/product1.
Linux: Deployed a Python script to /tmp/ld.py, launched detached via nohup python3. The RAT provided remote shell execution, process management, directory traversal, and system reconnaissance. It also attempted sh
Weaknesses (CWE)
CWE-506, CWE-829
Target sectors: technology, financial, cryptocurrency, software-development, cloud-infrastructure, devops
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1059, T1059, T1059, T1059, T1059, T1547, T1546, T1036, T1070