# Axios npm Supply Chain Compromise by Sapphire Sleet (DPRK) — Cross-Platform RAT via Phantom Dependency

> On March 31, 2026, North Korean state actor Sapphire Sleet (UNC1069/BlueNoroff) compromised the npm account of Axios maintainer jasonsaayman and published backdoored versions 1.14.1 and 0.30.4 of the Axios HTTP client library (~100M weekly downloads). The malicious versions injected a phantom dependency plain-crypto-js@4.2.1 whose postinstall hook contacted C2 infrastructure at sfrclak.com:8000 to deploy platform-specific RATs targeting Windows, macOS, and Linux systems.

- **Published:** 2026-04-01T12:00:00Z
- **Last reviewed:** 2026-10-16T11:28:43.705Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0311
- **ID:** TL-2026-0311
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** APT38 (North Korea)
- **Detections:** 9 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 31, 2026, a sophisticated supply chain attack was executed against the Axios npm package, one of the most widely used JavaScript HTTP client libraries with approximately 100 million weekly downloads and presence in roughly 80% of cloud and code environments. The attack was attributed to the North Korean state-sponsored threat actor Sapphire Sleet (also tracked as UNC1069, BlueNoroff, STARDUST CHOLLIMA, Alluring Pisces, CageyChameleon, and CryptoCore) by both Microsoft Threat Intelligence and Google Threat Intelligence Group.

The attack began with the compromise of the npm credentials belonging to jasonsaayman, the lead Axios maintainer. Evidence suggests a long-lived npm access token was stolen rather than credentials being phished, as the maintainer had MFA/2FA enabled. The npm platform prioritized the token over OIDC when both were present, allowing the attacker to bypass multi-factor authentication. The compromised account email was changed to ifstap@proton.me.

Prior to the main attack, the threat actor pre-staged infrastructure by creating the npm account nrwise (nrwise@proton.me) which published plain-crypto-js@4.2.0 as a clean decoy version approximately 18 hours before the attack, followed by the malicious 4.2.1 at 23:59 UTC on March 30. Two trojanized Axios versions were then published: v1.14.1 (tagged latest) at 00:21 UTC and v0.30.4 (tagged legacy) at 01:00 UTC on March 31, 2026.

The malicious Axios versions added plain-crypto-js@^4.2.1 as a dependency — a package never imported anywhere in the Axios source code. Its sole purpose was to execute a postinstall script (setup.js) that acted as a cross-platform RAT dropper. The dropper employed a custom two-layer obfuscation scheme: Layer 1 reversed an encoded string, replaced underscores with base64 padding characters, then decoded the result. Layer 2 applied XOR encryption using the key OrDeR_7077, selecting digits via the formula 7*i*i % 10 and XORing against constant 333. This dual approach obscured 18 critical strings including module names, C2 infrastructure, and shell commands from signature-based detection tools.

Upon execution, setup.js detected the host operating system and delivered platform-specific payloads:

macOS: Downloaded a Mach-O universal binary to /Library/Caches/com.apple.act.mond, masquerading as an Apple system daemon. The binary was launched via nohup osascript and identified itself to C2 with POST body packages.npm.org/product0. The RAT (internally named macWebT, linking to BlueNoroff webT module from RustBucket campaigns) generated a 16-character unique victim ID and fingerprinted the system (hostname, username, macOS version, timezone, CPU type, install date, boot time, running processes, application directories). It supported commands including peinject (binary injection with ad-hoc code signing via codesign --force --deep --sign -), runscript (shell/AppleScript execution), rundir (directory enumeration), and kill (process termination). It beaconed to C2 every 60 seconds using a deceptive User-Agent string mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0).

Windows: Copied PowerShell to %PROGRAMDATA%\wt.exe to impersonate Windows Terminal, then deployed a VBScript launcher (%TEMP%\6202033.vbs) with hidden window style (window style 0) that executed the PowerShell RAT (%TEMP%\6202033.ps1). Persistence was established via the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate. A resilience mechanism via system.bat at %PROGRAMDATA%\system.bat enabled re-download capability. The Windows RAT provided remote shell execution, binary injection, directory browsing, process listing, and system reconnaissance, beaconing C2 every 60 seconds. POST body identifier: packages.npm.org/product1.

Linux: Deployed a Python script to /tmp/ld.py, launched detached via nohup python3. The RAT provided remote shell execution, process management, directory traversal, and system reconnaissance. It also attempted shell profile injection (.bashrc, .zshrc) for persistence. POST body identifier: packages.npm.org/product2.

Post-execution, the dropper performed anti-forensics by deleting setup.js, removing the malicious package.json containing the postinstall hook, and restoring a clean package.json from a package.md backup, making the infected node_modules directory appear benign to inspection.

The malicious versions were live for approximately 2-3 hours (00:21 to ~03:15 UTC on March 31) before detection and removal. Despite this brief window, the first infection was observed just 89 seconds after publication (00:23:27 UTC), and Huntress observed 135+ endpoints contacting C2 across their partner base. Wiz reported a 3% execution rate across affected environments — a significant footprint given the package massive download volume.

Related malicious packages published by the same infrastructure include @shadanai/openclaw (versions 2026.3.28-2, 2026.3.28-3, 2026.3.31-1, 2026.3.31-2) and @qqbrowser/openclaw-qbot (version 0.0.130). Google Threat Intelligence Group identified the second-stage malware as WAVESHAPER.V2, an updated backdoor linked to UNC1069 earlier activity. The C2 domain calltan.com was also linked to prior DPRK binary usage per Volexity researchers.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1036 Masquerading
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1555 Credentials from Password Stores
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1566.002 Phishing
- T1055 Process Injection
- T1564.001 Hide Artifacts
- T1132.001 Data Encoding
- T1195.002 Supply Chain Compromise
- T1078 Valid Accounts
- T1204.005 User Execution
- T1059.007 Command and Scripting Interpreter
- T1059.001 Command and Scripting Interpreter
- T1059.005 Command and Scripting Interpreter
- T1059.006 Command and Scripting Interpreter
- T1059.002 Command and Scripting Interpreter
- T1547.001 Boot or Logon Autostart Execution
- T1140 Deobfuscate/Decode Files or Information
- T1036.003 Masquerading
- T1070.004 Indicator Removal
- T1620 Reflective Code Loading
- T1071.001 Application Layer Protocol

## Sources

- [Microsoft: Mitigating the Axios npm supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/)
- [Google Cloud: North Korea-Nexus Threat Actor Targets Axios NPM Package](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package)
- [Wiz: Axios NPM Distribution Compromised in Supply Chain Attack](https://www.wiz.io/blog/axios-npm-compromised-in-supply-chain-attack)
- [Huntress: Supply Chain Compromise of axios npm Package](https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package)
- [Socket: Supply Chain Attack on Axios Pulls Malicious Dependency](https://socket.dev/blog/axios-npm-package-compromised)
- [Aikido: axios compromised on npm — maintainer account hijacked, RAT deployed](https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat)
- [SANS: Axios NPM Supply Chain Compromise — Malicious Packages Deliver RAT](https://www.sans.org/blog/axios-npm-supply-chain-compromise-malicious-packages-remote-access-trojan)
- [StepSecurity: axios Compromised on npm — Malicious Versions Drop RAT](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan)
- [Snyk: Axios npm Package Compromised — Supply Chain Attack Delivers Cross-Platform RAT](https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/)
- [The Hacker News: Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account](https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html)
- [CyberScoop: Attack on axios software developer tool threatens widespread compromises](https://cyberscoop.com/axios-software-developer-tool-attack-compromise/)
- [SOCRadar: Axios npm Hijack 2026 — Everything You Need to Know](https://socradar.io/blog/axios-npm-supply-chain-attack-2026-ciso-guide/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0311