# Axios npm Supply Chain Compromise — WAVESHAPER.V2 Cross-Platform RAT Deployment by UNC1069/Sapphire Sleet (DPRK)

> North Korean threat actor UNC1069 (Sapphire Sleet) compromised the Axios npm maintainer account and published backdoored axios@1.14.1 and axios@0.30.4 packages injecting the malicious plain-crypto-js dependency, which deployed the cross-platform WAVESHAPER.V2 RAT across Windows, macOS, and Linux. Approximately 600,000 downloads occurred during the 3-hour exposure window (2026-03-31 00:21–03:25 UTC), with execution observed in 3% of affected environments. The RAT harvests npm tokens, SSH keys, CI/CD secrets, and cloud provider credentials, beaconing to sfrclak[.]com:8000 via HTTP POST every 60 seconds.

- **Published:** 2026-04-02T12:00:00Z
- **Last reviewed:** 2026-04-02T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0314
- **ID:** TL-2026-0314
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 31, 2026, a sophisticated supply chain attack targeted the Axios npm package — the most widely used HTTP client in the JavaScript ecosystem with approximately 100 million weekly downloads and presence in roughly 80% of cloud and code environments. The attack was executed by UNC1069 (tracked by Microsoft as Sapphire Sleet), a financially motivated North Korean state-sponsored threat cluster linked to BlueNoroff and active since at least 2018.

## Attack Vector

The attacker compromised the npm account of jasonsaayman, one of Axios’s primary maintainers, exploiting a coexistence vulnerability where OIDC Trusted Publishing configuration remained alongside legacy npm access tokens — with authentication logic prioritizing environment variables over OIDC verification. The compromised account email was changed to ifstap@proton[.]me. Within a 39-minute window, two backdoored versions were published: axios@1.14.1 (tagged latest) and axios@0.30.4 (tagged legacy).

## Kill Chain

Both malicious Axios versions injected plain-crypto-js@4.2.1 as a runtime dependency. A clean version (plain-crypto-js@4.2.0) had been pre-staged 18 hours earlier on March 30, 2026 to avoid suspicion. The malicious dependency’s postinstall hook executed setup.js — an obfuscated JavaScript dropper Google/Mandiant tracks as SILKBELL. The dropper implements two-layer obfuscation: reversed Base64 decoding followed by XOR cipher with key OrDeR_7077 using position-dependent index formula (7 * i² % 10) and constant 333. Critical strings are stored in an encoded array stq[] decoded at runtime.

## Platform-Specific Payloads

**Windows:** A VBScript (6202033.vbs) downloads a PowerShell script (6202033.ps1) via curl from the C2. PowerShell is copied to %PROGRAMDATA%\wt.exe and executed with -NoProfile -ep Bypass flags. Persistence is established via a Registry Run key labeled “Microsoft Update”. A batch file (system.bat) orchestrates initial staging.

**macOS:** AppleScript via /usr/bin/osascript downloads a C++ Mach-O binary to /Library/Caches/com.apple.act.mond. The binary’s internal build path (Jain_DEV/client_mac/macWebT/macWebT) establishes direct lineage to BlueNoroff’s webT module from RustBucket/Hidden Risk campaigns (2023). No persistence mechanism is implemented on macOS.

**Linux:** A Python loader is downloaded to /tmp/ld.py and executed via python3. No persistence mechanism is implemented on Linux.

## WAVESHAPER.V2 RAT Capabilities

The RAT beacons to sfrclak[.]com:8000/6202033 via HTTP POST every 60 seconds using a distinctive anachronistic User-Agent string (IE8/Windows XP). Communication uses Base64-encoded JSON with two-layer obfuscation. Each session generates a 16-character random alphanumeric UID.

Supported C2 commands:
- **kill**: Terminate RAT execution
- **rundir**: Enumerate directories with file metadata (name, size, type, timestamps, child count)
- **runscript**: Execute platform-native scripts (AppleScript/PowerShell/Shell) with Script and Param fields
- **peinject**: Reflective .NET assembly loading on Windows; Base64-decoded binary execution on macOS/Linux

Reconnaissance data collection includes hostname, username, OS version, timezone, boot time, install date, hardware model, CPU type, and full process enumeration. The primary objective is harvesting developer credentials: npm access tokens, SSH keys, CI/CD pipeline secrets (GitHub Actions, GitLab CI, Jenkins), and cloud provider keys (AWS, GCP, Azure).

## Anti-Forensics

The dropper self-deletes via fs.unlink(__filename) after execution and swaps the malicious package.json with a clean package.md file, overwriting forensic evidence. The RAT payloads are downloaded to temporary locations and in some cases execute from memory.

## Impact

Approximately 600,000 downloads occurred during the 3-hour exposure window. Given Axios’s ubiquity in CI/CD pipelines and developer workstations, any npm token, SSH key, cloud credential, or CI/CD secret present on an infected system should be considered compromised. Elastic observed execution in 3% of environments that downloaded the malicious packages.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1055 Process Injection
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1132 Data Encoding
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [SentinelOne: Securing the Supply Chain — Axios Attack Analysis](https://www.sentinelone.com/blog/securing-the-supply-chain-how-sentinelones-ai-edr-stops-the-axios-attack-autonomously/)
- [Microsoft: Mitigating the Axios npm Supply Chain Compromise](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/)
- [Google Cloud: North Korea-Nexus Threat Actor Compromises Axios NPM Package](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package)
- [Elastic Security Labs: Inside the Axios Supply Chain Compromise — One RAT to Rule Them All](https://www.elastic.co/security-labs/axios-one-rat-to-rule-them-all)
- [Huntress: Supply Chain Compromise of axios npm Package](https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package)
- [The Hacker News: Google Attributes Axios npm Supply Chain Attack to UNC1069](https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html)
- [The Hacker News: Axios Supply Chain Attack Pushes Cross-Platform RAT](https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html)
- [Tenable: Axios npm Supply Chain Attack FAQ](https://www.tenable.com/blog/faq-about-the-axios-npm-supply-chain-attack-by-north-korea-nexus-threat-actor-unc1069)
- [Wiz: Axios NPM Distribution Compromised in Supply Chain Attack](https://www.wiz.io/blog/axios-npm-compromised-in-supply-chain-attack)
- [SOCRadar: Axios npm Hijack 2026 — CISO Guide](https://socradar.io/blog/axios-npm-supply-chain-attack-2026-ciso-guide/)
- [CyberScoop: Attack on Axios Software Developer Tool](https://cyberscoop.com/axios-software-developer-tool-attack-compromise/)
- [SecurityWeek: Axios NPM Package Breached in North Korean Supply Chain Attack](https://www.securityweek.com/axios-npm-package-breached-in-north-korean-supply-chain-attack/)
- [Malwarebytes: Axios Supply Chain Attack Chops Away at npm Trust](https://www.malwarebytes.com/blog/news/2026/03/axios-supply-chain-attack-chops-away-at-npm-trust)
- [OX Security: Axios Compromised by Malicious NPM Dependency](https://www.ox.security/blog/axios-compromised-with-a-malicious-dependency/)
- [Security Boulevard: FAQ About the Axios npm Supply Chain Attack by UNC1069](https://securityboulevard.com/2026/04/frequently-asked-questions-about-the-axios-npm-supply-chain-attack-by-north-korea-nexus-threat-actor-unc1069/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0314