Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) Reaches OpenAI macOS Signing Pipeline, Forces Apple Certificate Rotation — DPRK UNC1069 / Sapphire Sleet WAVESHAPER.V2 — Threadlinqs Intelligence
As of 2026-05-30, Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) Reaches OpenAI macOS Signing Pipeline, Forces Apple Certificate Rotation — DPRK UNC1069 / Sapphire Sleet WAVESHAPER.V2 is a critical-severity supply chain threat attributed to UNC1069 (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-0351 · Severity: CRITICAL · CVSS: 9.6 · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: UNC1069 · North Korea · FINANCIAL
On 2026-03-31, North Korea-nexus actor UNC1069 (Microsoft: Sapphire Sleet; CrowdStrike: Stardust Chollima) published malicious versions of the axios npm package (1.14.1 and 0.30.4) that pulled in a
Overview
On 2026-03-30 at 23:59 UTC, threat actor UNC1069 published plain-crypto-js@4.2.1 to npm, a package that the group had previously staged with a clean decoy build (plain-crypto-js@4.2.0) hours earlier to blunt static reputation checks. At 2026-03-31 00:21 UTC the attacker pushed axios@1.14.1, and at 01:00 UTC axios@0.30.4, each of which declared plain-crypto-js@4.2.1 as a transitive dependency. The axios 1.x line is one of the most downloaded packages on npm (more than 100M weekly installs on 1.x and 83M on 0.x), and both malicious tarballs were served from the public registry for roughly three hours before npm unpublished them and Socket's runtime dashboards began blocking the install.
On the same day, OpenAI's internal GitHub Actions workflow responsible for signing and notarizing the macOS builds of ChatGPT Desktop, Codex, and Atlas auto-pulled the malicious axios release. The workflow referenced axios using a floating tag (^1.14.0) rather than a pinned hash and did not set a minimumReleaseAge, so within minutes of the malicious version appearing on the registry the CI runner resolved, downloaded, and executed it inside the signing job. That job held Apple Developer ID signing and notarization credentials, a webhook secret to OpenAI's internal release bus, and a short-lived OIDC token for the release GCS bucket. OpenAI has since stated that there is no evidence of actual exfiltration or downstream tampering of production binaries, but because the signing identity was exposed in memory on the runner it has been treated as fully burned.
Dropper chain and WAVESHAPER.V2
Installation of axios@1.14.1 pulled plain-crypto-js@4.2.1, whose package.json declared a postinstall hook that executed an obfuscated JavaScript dropper named setup.js (tracked by Google Threat Intelligence Group as SILKBELL). SILKBELL uses reversed Base64 plus a simple XOR cipher (key OrDeR_7077, constant 333) to hide strings, detects the runtime OS, and fetches the next stage over HTTP on port 8000 from sfrclak[.]com (142.11.206.73). The dropper then self-deletes, removes the malicious package.json, and renames a pre-staged package.md to package.json to restore a clean-looking installation.
The final payload is WAVESHAPER.V2, a cross-platform backdoor implemented as a C++ Mach-O binary on macOS, a PowerShell loader on Windows, and a Python script on Linux. WAVESHAPER.V2 beacons to the C2 every 60 seconds, spoofs a User-Agent of Internet Explorer 8 on Windows XP, and supports four commands: kill, rundir, runscript (executes AppleScript, PowerShell, or shell), and peinject (decodes and runs an arbitrary PE in memory). The macOS variant was built from a project path of Jain_DEV/client_mac/macWebT/macWebT, a direct code-lineage link to BlueNoroff's webT loader used in the Hidden Risk and RustBucket crypto-targeting campaigns.
Persistence differs per OS. Windows: WAVESHAPER.V2 drops %PROGRAMDATA%\wt.exe (a renamed legitimate powershell.exe) and %PROGRAMDATA%\system.bat, and registers HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate. macOS: the binary is written to /Library/Caches/com.apple.act.mond and launched via a LaunchAgent masquerading as an Apple Activity Monitor daemon. Linux: /tmp/ld.py is invoked via a cron line added to the user crontab.
Initial access to the Axios maintainer account
According to Socket CEO Feross Aboukhadijeh (TBPN, 2026-04-08), UNC1069 social-engineered the lead Axios maintainer over several weeks, standing up a fake company identity, a fake Slack workspace, and ultimately a staged Microsoft Teams call in which they delivered the initial malware under the pretense of a software update. The malware stole npm publish credentials and changed the associated npm account email to ifstap@proton.me, giving the attacker persistent publish access. This matches UNC1069's long-running recruiter-style lure tradecraft previously documented against cryptocurrency and Node.js maintainers.
Blast radius and OpenAI resp
Weaknesses (CWE)
CWE-1357, CWE-506, CWE-494, CWE-829
Target sectors: technology, ai-ml, software-development, devops, cicd, cryptocurrency, finance
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1585, T1586, T1587.001, T1583.001, T1195.001, T1195.002, T1566.003, T1199, T1059.007, T1059.001