Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) Reaches OpenAI macOS Signing Pipeline, Forces Apple Certificate Rotation — DPRK UNC1069 / Sapphire Sleet WAVESHAPER.V2

Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) (TL-2026-0351), also tracked as Axios npm Hijack 2026, is a critical-severity supply-chain compromise scored CVSS 9.6, first published 2026-04-11. It is attributed to UNC1069 (North Korea) with high confidence, affects axios axios (npm), maps to 29 MITRE ATT&CK techniques (T1027, T1036.005, T1041), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-0351

Threat ID
TL-2026-0351
Also known as
Axios npm Hijack 2026, SILKBELL dropper, WAVESHAPER.V2 campaign, Axios-OpenAI supply chain incident
Severity
CRITICAL
CVSS
9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L)
Status
MONITORING
Category
SUPPLY_CHAIN
First published
2026-04-11
Last reviewed
2026-04-11
Attribution
UNC1069
Attribution confidence
HIGH
Nation-state nexus
North Korea
Motivation
FINANCIAL
Target sectors
technology, ai-ml, software-development, devops, cicd, cryptocurrency, finance
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
22

Malware and tooling in Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4)

Malware and tooling: SILKBELL, WAVESHAPER, Jain_DEV/client_mac/macWebT/macWebT, WAVESHAPER.V2 JSON-over-HTTP

On 2026-03-31, North Korea-nexus actor UNC1069 (Microsoft: Sapphire Sleet; CrowdStrike: Stardust Chollima) published malicious versions of the axios npm package (1.14.1 and 0.30.4) that pulled in a trojanized plain-crypto-js@4.2.1 dependency, which in turn dropped the SILKBELL loader and the cross-platform WAVESHAPER.V2 backdoor. The poisoned axios release was auto-pulled into OpenAI's GitHub Actions macOS app-signing workflow roughly 20 minutes after publication due to a floating tag reference and a missing minimumReleaseAge, exposing the Apple code signing certificate used to notarize ChatGPT Desktop, Codex, and Atlas. OpenAI revoked and rotated the certificate, Apple revoked notarization for the previous certificate, and all three desktop apps must be updated by 2026-05-08 or will stop functioning.

How Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) works

Overview

On 2026-03-30 at 23:59 UTC, threat actor UNC1069 published plain-crypto-js@4.2.1 to npm, a package that the group had previously staged with a clean decoy build (plain-crypto-js@4.2.0) hours earlier to blunt static reputation checks. At 2026-03-31 00:21 UTC the attacker pushed axios@1.14.1, and at 01:00 UTC axios@0.30.4, each of which declared plain-crypto-js@4.2.1 as a transitive dependency. The axios 1.x line is one of the most downloaded packages on npm (more than 100M weekly installs on 1.x and 83M on 0.x), and both malicious tarballs were served from the public registry for roughly three hours before npm unpublished them and Socket's runtime dashboards began blocking the install.

On the same day, OpenAI's internal GitHub Actions workflow responsible for signing and notarizing the macOS builds of ChatGPT Desktop, Codex, and Atlas auto-pulled the malicious axios release. The workflow referenced axios using a floating tag (^1.14.0) rather than a pinned hash and did not set a minimumReleaseAge, so within minutes of the malicious version appearing on the registry the CI runner resolved, downloaded, and executed it inside the signing job. That job held Apple Developer ID signing and notarization credentials, a webhook secret to OpenAI's internal release bus, and a short-lived OIDC token for the release GCS bucket. OpenAI has since stated that there is no evidence of actual exfiltration or downstream tampering of production binaries, but because the signing identity was exposed in memory on the runner it has been treated as fully burned.

Dropper chain and WAVESHAPER.V2

Installation of axios@1.14.1 pulled plain-crypto-js@4.2.1, whose package.json declared a postinstall hook that executed an obfuscated JavaScript dropper named setup.js (tracked by Google Threat Intelligence Group as SILKBELL). SILKBELL uses reversed Base64 plus a simple XOR cipher (key OrDeR_7077, constant 333) to hide strings, detects the runtime OS, and fetches the next stage over HTTP on port 8000 from sfrclak[.]com (142.11.206.73). The dropper then self-deletes, removes the malicious package.json, and renames a pre-staged package.md to package.json to restore a clean-looking installation.

The final payload is WAVESHAPER.V2, a cross-platform backdoor implemented as a C++ Mach-O binary on macOS, a PowerShell loader on Windows, and a Python script on Linux. WAVESHAPER.V2 beacons to the C2 every 60 seconds, spoofs a User-Agent of Internet Explorer 8 on Windows XP, and supports four commands: kill, rundir, runscript (executes AppleScript, PowerShell, or shell), and peinject (decodes and runs an arbitrary PE in memory). The macOS variant was built from a project path of Jain_DEV/client_mac/macWebT/macWebT, a direct code-lineage link to BlueNoroff's webT loader used in the Hidden Risk and RustBucket crypto-targeting campaigns.

Persistence differs per OS. Windows: WAVESHAPER.V2 drops %PROGRAMDATA%\wt.exe (a renamed legitimate powershell.exe) and %PROGRAMDATA%\system.bat, and registers HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate. macOS: the binary is written to /Library/Caches/com.apple.act.mond and launched via a LaunchAgent masquerading as an Apple Activity Monitor daemon. Linux: /tmp/ld.py is invoked via a cron line added to the user crontab.

Initial access to the Axios maintainer account

According to Socket CEO Feross Aboukhadijeh (TBPN, 2026-04-08), UNC1069 social-engineered the lead Axios maintainer over several weeks, standing up a fake company identity, a fake Slack workspace, and ultimately a staged Microsoft Teams call in which they delivered the initial malware under the pretense of a software update. The malware stole npm publish credentials and changed the associated npm account email to ifstap@proton.me, giving the attacker persistent publish access. This matches UNC1069's long-running recruiter-style lure tradecraft previously documented against cryptocurrency and Node.js maintainers.

Blast radius and OpenAI response

StepSecurity Harden-Runner telemetry identified anomalous outbound traffic to sfrclak[.]com in more than 12,000 GitHub Actions runs during the three-hour exposure window, and Google Threat Intelligence Group assessed that hundreds of thousands of CI/CD secrets could potentially be circulating. OpenAI's disclosure on 2026-04-11 states that the exposed macOS Developer ID certificate has been revoked, Apple has blocked notarization using the previous certificate, and all ChatGPT Desktop, Codex, and Atlas installations must be updated by 2026-05-08 or will refuse to launch on current macOS.

Safe versions are axios@1.14.0 and axios@0.30.3. Downstream consumers should remove node_modules/plain-crypto-js entirely, rotate any credentials that were in memory on runners that touched the malicious versions, block sfrclak[.]com and 142.11.206.73 at the perimeter, and enforce a seven-day minimum release age across npm, pnpm, Yarn Berry, and Bun as a permanent version-cooldown control.

MITRE ATT&CK techniques used in TL-2026-0351

defense-evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1053.003 Cron; T1059.001 PowerShell; T1059.002 AppleScript; T1059.004 Unix Shell; T1059.006 Python; T1059.007 JavaScript

command-and-control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

initial-access

T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship; T1566.003 Spearphishing via Service

persistence

T1543.001 Launch Agent; T1547.001 Registry Run Keys / Startup Folder

credential-access

T1552.001 Credentials In Files; T1552.007 Container API

defense-impairment

T1553.002 Code Signing

resource-development

T1583.001 Domains; T1585 Establish Accounts; T1586 Compromise Accounts; T1587.001 Malware

Affected products and versions in Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4)

  • axios — axios (npm)
    Vulnerable versions: 1.14.1; 0.30.4
    Fixed in: 1.14.0; 0.30.3
  • Unknown (malicious) — plain-crypto-js (npm)
    Vulnerable versions: 4.2.1
  • OpenAI — ChatGPT Desktop (macOS)
    Vulnerable versions: all builds signed with pre-rotation Developer ID certificate
    Fixed in: 2026-04-11 re-signed build and later
  • OpenAI — Codex (macOS)
    Vulnerable versions: all builds signed with pre-rotation Developer ID certificate
    Fixed in: 2026-04-11 re-signed build and later
  • OpenAI — Atlas (macOS)
    Vulnerable versions: all builds signed with pre-rotation Developer ID certificate
    Fixed in: 2026-04-11 re-signed build and later
  • GitHub — GitHub Actions workflows using floating tags without minimumReleaseAge
    Vulnerable versions: any workflow resolving axios^1.14.0 between 2026-03-31 00:21 and 04:26 UTC

Remediation for Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4)

Patches

  • axios 1.14.0 (safe, pre-malicious)
  • axios 0.30.3 (safe, pre-malicious)
  • OpenAI macOS re-signed builds for ChatGPT Desktop, Codex, Atlas released 2026-04-11

Immediate actions

  • Downgrade to axios@1.14.0 or axios@0.30.3 and remove node_modules/plain-crypto-js entirely
  • Rotate every credential, token, and secret that was present in memory on any runner that installed axios@1.14.1 or axios@0.30.4 between 2026-03-31 00:21 UTC and 04:26 UTC
  • Treat any host that executed the malicious package as fully compromised; rebuild from a known-good snapshot rather than cleaning in place
  • Block sfrclak[.]com and 142.11.206.73:8000 at perimeter and DNS
  • For OpenAI desktop app users, update ChatGPT Desktop, Codex, and Atlas to the newly re-signed builds before 2026-05-08

Workarounds

  • Temporarily pin axios to an exact version below 1.14.1 and above 1.0.0 in package.json and package-lock.json
  • Disable postinstall scripts globally via --ignore-scripts during emergency remediation
  • Audit any CI/CD workflow with access to code signing materials and disable it until dependency resolution has been fully pinned

Longer-term hardening

  • Enforce a minimum release age of at least 7 days on every package manager: npm min-release-age=7d, pnpm minimum-release-age=7d, Yarn Berry npmMinimalAgeGate=7d, Bun minimumReleaseAge=604800
  • Pin every third-party dependency in CI to a specific commit SHA or integrity hash, never a floating semver range
  • Require OIDC provenance and SLSA build attestations for every first-party package, and reject installs that lack attestations in production CI
  • Segment code-signing and notarization jobs into isolated, single-purpose runners with no general-purpose dependency resolution
  • Deploy StepSecurity Harden-Runner or equivalent egress-firewalling on all GitHub Actions workflows that touch signing material

Weaknesses (CWE) in Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4)

CWE-1357, CWE-506, CWE-494, CWE-829

Timeline of Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4)

  • Malicious plain-crypto-js@4.2.1 published to npm at 23:59 UTC with an obfuscated setup.js postinstall hook (SILKBELL).
  • UNC1069 publishes plain-crypto-js@4.2.0 at 05:57 UTC as a clean decoy to build package reputation before the malicious drop.
  • At 04:26 UTC npm replaces the malicious plain-crypto-js with a benign security stub, ending the three-hour exposure window.
  • npm unpublishes axios@1.14.1 and axios@0.30.4 at approximately 03:15 UTC and places plain-crypto-js on security hold at 03:25 UTC.
  • Elastic Security Labs files a GitHub Security Advisory for the malicious axios releases at 01:50 UTC.
  • OpenAI's GitHub Actions macOS signing workflow auto-resolves axios@1.14.1 via a floating ^1.14.0 tag with no minimumReleaseAge and executes the SILKBELL dropper inside the signing job.
  • Malicious axios@0.30.4 published to npm at 01:00 UTC to cover downstream consumers still pinned to the 0.x branch.
  • Malicious axios@1.14.1 published to npm at 00:21 UTC, depending on plain-crypto-js@4.2.1.
  • Socket.dev's automated pipeline flags plain-crypto-js@4.2.1 as malicious at approximately 00:05 UTC, roughly six minutes after publication.
  • Google Threat Intelligence Group and Microsoft Threat Intelligence publicly attribute the compromise to UNC1069 / Sapphire Sleet and confirm WAVESHAPER.V2 lineage.
  • CrowdStrike publishes corroborating attribution to Stardust Chollima with moderate confidence, citing BlueNoroff-adjacent tradecraft and the Jain_DEV/client_mac/macWebT build path.
  • Socket CEO Feross Aboukhadijeh details the weeks-long social engineering of the Axios maintainer — fake company, fake Slack, staged Microsoft Teams call — on the TBPN podcast.
  • OpenAI publicly discloses that the exposed macOS Developer ID certificate has been revoked and rotated, Apple has blocked notarization using the prior certificate, and ChatGPT Desktop, Codex, and Atlas must be updated by 2026-05-08 or will stop launching.
  • Hard deadline: macOS installations of ChatGPT Desktop, Codex, and Atlas still signed with the revoked certificate will stop functioning.
  • As of 2026-05-29, the axios npm compromise itself is contained — malicious 1.14.1/0.30.4 and plain-crypto-js were unpublished within ~3 hours, safe versions exist, the C2/IOCs are burned, and OpenAI's rotated cert plus the now-passed 2026-05-08 forced-update deadline closed the exposure. However the DPRK actor (UNC1069/Sapphire Sleet/BlueNoroff) and WAVESHAPER.V2 tooling remain highly active in 2026, so the threat persists and could resurge.

Sources cited for Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4)

Threats related to Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4)

Detection coverage for TL-2026-0351

As of 2026-04-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0351 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats