Axios npm Supply Chain Compromise — WAVESHAPER.V2 Cross-Platform RAT Deployment by UNC1069/Sapphire Sleet (DPRK)

Axios npm Supply Chain Compromise (TL-2026-0314), also tracked as Axios npm Hijack 2026, is a critical-severity supply-chain compromise, first published 2026-04-02. It is attributed to UNC1069 (North Korea) with high confidence, affects axios axios, maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-0314

Threat ID
TL-2026-0314
Also known as
Axios npm Hijack 2026, Operation WAVESHAPER
Severity
CRITICAL
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-04-02
Last reviewed
2026-04-02
Attribution
UNC1069
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, financial, cryptocurrency, cloud-services, software-development, devops
Target regions
Global
Detection rules
9
Indicators of compromise
31

Malware and tooling in Axios npm Supply Chain Compromise

Malware and tooling: SILKBELL, WAVESHAPER, WAVESHAPER.V2

North Korean threat actor UNC1069 (Sapphire Sleet) compromised the Axios npm maintainer account and published backdoored axios@1.14.1 and axios@0.30.4 packages injecting the malicious plain-crypto-js dependency, which deployed the cross-platform WAVESHAPER.V2 RAT across Windows, macOS, and Linux. Approximately 600,000 downloads occurred during the 3-hour exposure window (2026-03-31 00:21–03:25 UTC), with execution observed in 3% of affected environments. The RAT harvests npm tokens, SSH keys, CI/CD secrets, and cloud provider credentials, beaconing to sfrclak[.]com:8000 via HTTP POST every 60 seconds.

How Axios npm Supply Chain Compromise works

On March 31, 2026, a sophisticated supply chain attack targeted the Axios npm package — the most widely used HTTP client in the JavaScript ecosystem with approximately 100 million weekly downloads and presence in roughly 80% of cloud and code environments. The attack was executed by UNC1069 (tracked by Microsoft as Sapphire Sleet), a financially motivated North Korean state-sponsored threat cluster linked to BlueNoroff and active since at least 2018.

## Attack Vector

The attacker compromised the npm account of jasonsaayman, one of Axios’s primary maintainers, exploiting a coexistence vulnerability where OIDC Trusted Publishing configuration remained alongside legacy npm access tokens — with authentication logic prioritizing environment variables over OIDC verification. The compromised account email was changed to ifstap@proton[.]me. Within a 39-minute window, two backdoored versions were published: axios@1.14.1 (tagged latest) and axios@0.30.4 (tagged legacy).

## Kill Chain

Both malicious Axios versions injected plain-crypto-js@4.2.1 as a runtime dependency. A clean version (plain-crypto-js@4.2.0) had been pre-staged 18 hours earlier on March 30, 2026 to avoid suspicion. The malicious dependency’s postinstall hook executed setup.js — an obfuscated JavaScript dropper Google/Mandiant tracks as SILKBELL. The dropper implements two-layer obfuscation: reversed Base64 decoding followed by XOR cipher with key OrDeR_7077 using position-dependent index formula (7 * i² % 10) and constant 333. Critical strings are stored in an encoded array stq[] decoded at runtime.

## Platform-Specific Payloads

**Windows:** A VBScript (6202033.vbs) downloads a PowerShell script (6202033.ps1) via curl from the C2. PowerShell is copied to %PROGRAMDATA%\wt.exe and executed with -NoProfile -ep Bypass flags. Persistence is established via a Registry Run key labeled “Microsoft Update”. A batch file (system.bat) orchestrates initial staging.

**macOS:** AppleScript via /usr/bin/osascript downloads a C++ Mach-O binary to /Library/Caches/com.apple.act.mond. The binary’s internal build path (Jain_DEV/client_mac/macWebT/macWebT) establishes direct lineage to BlueNoroff’s webT module from RustBucket/Hidden Risk campaigns (2023). No persistence mechanism is implemented on macOS.

**Linux:** A Python loader is downloaded to /tmp/ld.py and executed via python3. No persistence mechanism is implemented on Linux.

## WAVESHAPER.V2 RAT Capabilities

The RAT beacons to sfrclak[.]com:8000/6202033 via HTTP POST every 60 seconds using a distinctive anachronistic User-Agent string (IE8/Windows XP). Communication uses Base64-encoded JSON with two-layer obfuscation. Each session generates a 16-character random alphanumeric UID.

Supported C2 commands: - **kill**: Terminate RAT execution - **rundir**: Enumerate directories with file metadata (name, size, type, timestamps, child count) - **runscript**: Execute platform-native scripts (AppleScript/PowerShell/Shell) with Script and Param fields - **peinject**: Reflective .NET assembly loading on Windows; Base64-decoded binary execution on macOS/Linux

Reconnaissance data collection includes hostname, username, OS version, timezone, boot time, install date, hardware model, CPU type, and full process enumeration. The primary objective is harvesting developer credentials: npm access tokens, SSH keys, CI/CD pipeline secrets (GitHub Actions, GitLab CI, Jenkins), and cloud provider keys (AWS, GCP, Azure).

## Anti-Forensics

The dropper self-deletes via fs.unlink(__filename) after execution and swaps the malicious package.json with a clean package.md file, overwriting forensic evidence. The RAT payloads are downloaded to temporary locations and in some cases execute from memory.

## Impact

Approximately 600,000 downloads occurred during the 3-hour exposure window. Given Axios’s ubiquity in CI/CD pipelines and developer workstations, any npm token, SSH key, cloud credential, or CI/CD secret present on an infected system should be considered compromised. Elastic observed execution in 3% of environments that downloaded the malicious packages.

MITRE ATT&CK techniques used in TL-2026-0314

collection

T1005 Data from Local System

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1564 Hide Artifacts

exfiltration

T1041 Exfiltration Over C2 Channel

discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

execution

T1059 Command and Scripting Interpreter

command-and-control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1571 Non-Standard Port

initial-access

T1195 Supply Chain Compromise

persistence

T1547 Boot or Logon Autostart Execution

credential-access

T1552 Unsecured Credentials

Affected products and versions in Axios npm Supply Chain Compromise

  • axios — axios
    Vulnerable versions: 1.14.1; 0.30.4
    Fixed in: 1.14.2; 0.30.5
  • npm — plain-crypto-js
    Vulnerable versions: 4.2.1

Remediation for Axios npm Supply Chain Compromise

Patches

  • Upgrade to clean Axios versions (1.14.2+ or 0.30.5+)
  • Pin axios to known-good versions in lockfiles
  • Remove plain-crypto-js from all dependency trees

Immediate actions

  • Search all environments for axios@1.14.1, axios@0.30.4, and plain-crypto-js in node_modules
  • Block sfrclak[.]com and 142.11.206.73 at perimeter firewalls and DNS
  • Block outbound connections to port 8000
  • Treat any system that installed compromised packages during 2026-03-31 00:21-03:25 UTC as fully compromised
  • Isolate affected developer workstations and CI/CD runners
  • Search for file artifacts: com.apple.act.mond (macOS), wt.exe (Windows), ld.py (Linux)
  • Check Windows registry for 'Microsoft Update' Run key persistence

Workarounds

  • Run npm ci --ignore-scripts to prevent postinstall execution
  • Delete node_modules/plain-crypto-js/ directory
  • Run npm cache clean --force
  • Audit and recommit lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml)

Longer-term hardening

  • Deploy EDR with behavioral detection on all developer workstations and CI/CD runners
  • Implement npm package pinning and lockfile enforcement
  • Enable npm audit in CI/CD pipelines
  • Disable postinstall scripts by default (npm install --ignore-scripts)
  • Implement OIDC Trusted Publishing and revoke legacy npm access tokens
  • Deploy network monitoring for anomalous HTTP POST beaconing patterns
  • Establish supply chain security review process for critical dependencies

Weaknesses (CWE) in Axios npm Supply Chain Compromise

CWE-502, CWE-506, CWE-829, CWE-494

Timeline of Axios npm Supply Chain Compromise

  • UNC1069 first tracked as active financially motivated DPRK threat cluster targeting cryptocurrency sector
  • Clean plain-crypto-js@4.2.0 published to npm registry as pre-staging decoy (18 hours before detonation)
  • npm security advisory published; community-wide alerts issued across security vendor channels
  • Malicious axios versions removed from npm registry at approximately 03:25 UTC after 3-hour exposure window (~600,000 downloads)
  • First infection observed 89 seconds after publication at 00:22:29 UTC — WAVESHAPER.V2 RAT deployed on victim system
  • Attacker compromises npm maintainer account (jasonsaayman), changes email to ifstap@proton[.]me, publishes backdoored axios@1.14.1 (latest) and axios@0.30.4 (legacy) at 00:21 UTC
  • Huntress and Wiz publish independent technical analyses confirming cross-platform RAT deployment and credential harvesting capabilities
  • Microsoft Threat Intelligence attributes compromise to Sapphire Sleet (North Korean state actor); publishes detailed mitigation guidance
  • SentinelOne and Elastic Security Labs publish comprehensive reverse engineering analysis including full C2 protocol, obfuscation details, and platform-specific payload behavior
  • Google/Mandiant attributes to UNC1069, identifies SILKBELL dropper and WAVESHAPER.V2 RAT with lineage to BlueNoroff webT module from RustBucket campaigns
  • As of 2026-05-29, the specific Axios compromise is contained (malicious axios 1.14.1/0.30.4 + plain-crypto-js pulled in ~3hrs on 3/31, fixes 1.14.2/0.30.5 shipped), but UNC1069/Sapphire Sleet remains active. The actor expanded into broader OSS supply chains (1,700+ malicious packages, 164 domains blocked through Apr 7) with WAVESHAPER persisting and no takedowns or arrests.

Sources cited for Axios npm Supply Chain Compromise

Threats related to Axios npm Supply Chain Compromise

Detection coverage for TL-2026-0314

As of 2026-04-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0314 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats