# Axios npm Supply Chain Compromise (v1.14.1 / v0.30.4) Reaches OpenAI macOS Signing Pipeline, Forces Apple Certificate Rotation — DPRK UNC1069 / Sapphire Sleet WAVESHAPER.V2

> On 2026-03-31, North Korea-nexus actor UNC1069 (Microsoft: Sapphire Sleet; CrowdStrike: Stardust Chollima) published malicious versions of the axios npm package (1.14.1 and 0.30.4) that pulled in a trojanized plain-crypto-js@4.2.1 dependency, which in turn dropped the SILKBELL loader and the cross-platform WAVESHAPER.V2 backdoor. The poisoned axios release was auto-pulled into OpenAI's GitHub Actions macOS app-signing workflow roughly 20 minutes after publication due to a floating tag reference and a missing minimumReleaseAge, exposing the Apple code signing certificate used to notarize ChatGPT Desktop, Codex, and Atlas. OpenAI revoked and rotated the certificate, Apple revoked notarization for the previous certificate, and all three desktop apps must be updated by 2026-05-08 or will stop functioning.

- **Published:** 2026-04-11T12:00:00Z
- **Last reviewed:** 2026-04-11T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0351
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-axios-npm-hijack-unc1069-tl-2026-0351.webp?v=a4ab87d4 (Threadlinqs threat intel: UNC1069 Axios Hijack Hits OpenAI Signing: Detection & IOCs (TL-2026-0351) — Critical severity, 22 IOCs, 9 detection rules.)
- **ID:** TL-2026-0351
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

Overview

On 2026-03-30 at 23:59 UTC, threat actor UNC1069 published plain-crypto-js@4.2.1 to npm, a package that the group had previously staged with a clean decoy build (plain-crypto-js@4.2.0) hours earlier to blunt static reputation checks. At 2026-03-31 00:21 UTC the attacker pushed axios@1.14.1, and at 01:00 UTC axios@0.30.4, each of which declared plain-crypto-js@4.2.1 as a transitive dependency. The axios 1.x line is one of the most downloaded packages on npm (more than 100M weekly installs on 1.x and 83M on 0.x), and both malicious tarballs were served from the public registry for roughly three hours before npm unpublished them and Socket's runtime dashboards began blocking the install.

On the same day, OpenAI's internal GitHub Actions workflow responsible for signing and notarizing the macOS builds of ChatGPT Desktop, Codex, and Atlas auto-pulled the malicious axios release. The workflow referenced axios using a floating tag (^1.14.0) rather than a pinned hash and did not set a minimumReleaseAge, so within minutes of the malicious version appearing on the registry the CI runner resolved, downloaded, and executed it inside the signing job. That job held Apple Developer ID signing and notarization credentials, a webhook secret to OpenAI's internal release bus, and a short-lived OIDC token for the release GCS bucket. OpenAI has since stated that there is no evidence of actual exfiltration or downstream tampering of production binaries, but because the signing identity was exposed in memory on the runner it has been treated as fully burned.

Dropper chain and WAVESHAPER.V2

Installation of axios@1.14.1 pulled plain-crypto-js@4.2.1, whose package.json declared a postinstall hook that executed an obfuscated JavaScript dropper named setup.js (tracked by Google Threat Intelligence Group as SILKBELL). SILKBELL uses reversed Base64 plus a simple XOR cipher (key OrDeR_7077, constant 333) to hide strings, detects the runtime OS, and fetches the next stage over HTTP on port 8000 from sfrclak[.]com (142.11.206.73). The dropper then self-deletes, removes the malicious package.json, and renames a pre-staged package.md to package.json to restore a clean-looking installation.

The final payload is WAVESHAPER.V2, a cross-platform backdoor implemented as a C++ Mach-O binary on macOS, a PowerShell loader on Windows, and a Python script on Linux. WAVESHAPER.V2 beacons to the C2 every 60 seconds, spoofs a User-Agent of Internet Explorer 8 on Windows XP, and supports four commands: kill, rundir, runscript (executes AppleScript, PowerShell, or shell), and peinject (decodes and runs an arbitrary PE in memory). The macOS variant was built from a project path of Jain_DEV/client_mac/macWebT/macWebT, a direct code-lineage link to BlueNoroff's webT loader used in the Hidden Risk and RustBucket crypto-targeting campaigns.

Persistence differs per OS. Windows: WAVESHAPER.V2 drops %PROGRAMDATA%\wt.exe (a renamed legitimate powershell.exe) and %PROGRAMDATA%\system.bat, and registers HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate. macOS: the binary is written to /Library/Caches/com.apple.act.mond and launched via a LaunchAgent masquerading as an Apple Activity Monitor daemon. Linux: /tmp/ld.py is invoked via a cron line added to the user crontab.

Initial access to the Axios maintainer account

According to Socket CEO Feross Aboukhadijeh (TBPN, 2026-04-08), UNC1069 social-engineered the lead Axios maintainer over several weeks, standing up a fake company identity, a fake Slack workspace, and ultimately a staged Microsoft Teams call in which they delivered the initial malware under the pretense of a software update. The malware stole npm publish credentials and changed the associated npm account email to ifstap@proton.me, giving the attacker persistent publish access. This matches UNC1069's long-running recruiter-style lure tradecraft previously documented against cryptocurrency and Node.js maintainers.

Blast radius and OpenAI response

StepSecurity Harden-Runner telemetry identified anomalous outbound traffic to sfrclak[.]com in more than 12,000 GitHub Actions runs during the three-hour exposure window, and Google Threat Intelligence Group assessed that hundreds of thousands of CI/CD secrets could potentially be circulating. OpenAI's disclosure on 2026-04-11 states that the exposed macOS Developer ID certificate has been revoked, Apple has blocked notarization using the previous certificate, and all ChatGPT Desktop, Codex, and Atlas installations must be updated by 2026-05-08 or will refuse to launch on current macOS.

Safe versions are axios@1.14.0 and axios@0.30.3. Downstream consumers should remove node_modules/plain-crypto-js entirely, rotate any credentials that were in memory on runners that touched the malicious versions, block sfrclak[.]com and 142.11.206.73 at the perimeter, and enforce a seven-day minimum release age across npm, pnpm, Yarn Berry, and Bun as a permanent version-cooldown control.

## MITRE ATT&CK

- T1585 Establish Accounts
- T1586 Compromise Accounts
- T1587.001 Malware
- T1583.001 Domains
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1566.003 Spearphishing via Service
- T1199 Trusted Relationship
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1059.006 Python
- T1059.002 AppleScript
- T1547.001 Registry Run Keys / Startup Folder
- T1543.001 Launch Agent
- T1053.003 Cron
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Code Signing
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1552.001 Credentials In Files
- T1552.007 Container API
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WAVESHAPER.V2 C2 Beacon — IE8/WinXP User-Agent on TCP/8000** (`TL-2026-0351-SPL-003`)

Detects WAVESHAPER.V2 command-and-control beacons: outbound HTTP on non-standard TCP/8000 with the hardcoded IE8/WinXP User-Agent 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)', or connections to the known C2 domain sfrclak[.]com / 142.11.206.73. Beacon cadence is approximately 60 seconds.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1571, T1105, T1041
- **Data sources:** proxy, zeek, firewall, edr_network_events, dns
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype IN ("bro:http:json","zeek:http","ms:defender:network","paloalto","pan:threat") (user_agent="Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)" OR http_user_agent="Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)" OR dest="142.11.206.73" OR dest_host="sfrclak.com" OR url="*sfrclak.com*" OR (dest_port=8000 AND method="POST")) | eval indicator=case(like(user_agent,"%MSIE 8.0; Windows NT 5.1%"),"spoofed_ie8_ua", dest="142.11.206.73" OR like(url,"%sfrclak.com%") OR dest_host="sfrclak.com","waveshaper_c2_infra", dest_port=8000 AND method="POST","nonstandard_port_post") | stats count min(_time) AS first_seen max(_time) AS last_seen values(user_agent) AS uas values(url) AS urls values(dest) AS dests values(src) AS sources by host, indicator | where count>=1 | sort -last_seen
```

### Microsoft KQL

```kql
// KQL equivalent — WAVESHAPER.V2 C2 beacon detection
let ua_spoof = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)";
let waveshaper_iocs = dynamic(["sfrclak.com","142.11.206.73"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (RemoteUrl has_any (waveshaper_iocs))
    or (RemoteIP in (waveshaper_iocs))
    or (RemotePort == 8000 and Protocol == "Tcp" and ActionType == "ConnectionSuccess")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Protocol
| union (
    DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "BrowserLaunchedToOpenUrl" or AdditionalFields has ua_spoof
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl=tostring(parse_json(AdditionalFields).Url), RemoteIP="", RemotePort=int(null), Protocol=""
)
| order by Timestamp desc
```

### Sigma

```yaml
title: WAVESHAPER.V2 Beacon — IE8/WinXP UA or sfrclak.com C2 (TL-2026-0351)
id: 4a1e9d33-0351-4b12-9c77-waveshaper2bc2
status: experimental
description: Detects outbound HTTP POST on TCP/8000 with the hardcoded WAVESHAPER.V2 IE8/WinXP User-Agent, or any contact with the WAVESHAPER.V2 C2 infrastructure (sfrclak[.]com, 142.11.206.73) from the UNC1069 Axios npm supply chain compromise.
references:
    - https://socket.dev/blog/axios-supply-chain-attack-reaches-openai-macos-signing-pipeline-forces-certificate-rotation
    - https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
author: Threadlinqs Team
date: 2026/04/11
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1571
    - attack.t1105
logsource:
    category: proxy
detection:
    selection_ua_port:
        c-useragent: 'Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1)'
        dst-port: 8000
        cs-method: 'POST'
    selection_infra:
        cs-host:
            - 'sfrclak.com'
            - '142.11.206.73'
    condition: selection_ua_port or selection_infra
falsepositives:
    - Legacy IE8 kiosks or test harnesses deliberately spoofing the XP User-Agent (rare on modern fleets)
    - Security research reproducing the C2 protocol against an internal sinkhole
level: critical

```

**Known false positives:**

- Legacy IE8 applications or mobile device emulators legitimately using the same UA on modern networks
- Internal sinkholes or purple-team range traffic replaying the C2 indicators

**Tuning notes:** Alert immediately on any hit to sfrclak.com or 142.11.206.73. For UA+port match, optionally require the source process to be node.exe, powershell.exe, or python3 to reduce noise from legacy IE8 kiosks. Extend destination list if additional UNC1069 C2 nodes are published.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Axios Malicious Version Installed in CI/CD — Exploitation Trigger (locked: unlock with TL Creds)
- WAVESHAPER.V2 macOS LaunchAgent Persistence — com.apple.act.mond (locked: unlock with TL Creds)
- Node Process Initiating Outbound to TCP/8000 Post-Install — C2 Egress (locked: unlock with TL Creds)
- SILKBELL Obfuscated [indicator] Writing plain-crypto-js package.md Swap (locked: unlock with TL Creds)
- WAVESHAPER.V2 Linux Cron Persistence — [indicator] Execution (locked: unlock with TL Creds)
- CI/CD Floating-Tag Axios Resolution — Post-Exploitation Visibility (locked: unlock with TL Creds)
- SILKBELL npm Postinstall Dropper — Exploitation (Axios/plain-crypto-js) (locked: unlock with TL Creds)
- WAVESHAPER.V2 Windows Run-Key Persistence — Post-Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `142.11.206[.]73`
- Domain: `sfrclak[.]com`
- File hash: `c5adea0fa8aac14e6aabd8d3d4a1d19e4cd0eb76e679f2e9d3fed2a3170c09bb`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation](https://socket.dev/blog/axios-supply-chain-attack-reaches-openai-macos-signing-pipeline-forces-certificate-rotation)
- [Feross on TBPN: How North Korea Hijacked Axios](https://socket.dev/blog/feross-on-tbpn-how-north-korea-hijacked-axios)
- [North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package)
- [Mitigating the Axios npm supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/)
- [Frequently Asked Questions About the Axios npm Supply Chain Attack by North Korea-Nexus Threat Actor UNC1069](https://www.tenable.com/blog/faq-about-the-axios-npm-supply-chain-attack-by-north-korea-nexus-threat-actor-unc1069)
- [Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069](https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html)
- [Backdooring of JavaScript Library Axios Tied to North Korea](https://www.govinfosecurity.com/backdooring-javascript-library-axios-tied-to-north-korea-a-31308)
- [Axios supply chain attack chops away at npm trust](https://www.malwarebytes.com/blog/news/2026/03/axios-supply-chain-attack-chops-away-at-npm-trust)
- [North Korea Linked Hackers Compromise Axios npm Package](https://seceon.com/north-korea-linked-hackers-compromise-axios-npm-package/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0351