Threat reportSupply ChainTL-2026-3758
Malicious open-source packages: axios npm account hijack (plain-crypto-js / WAVESHAPER.V2), tensorflow-opt PyPI miner, and Contagious Interview multi-ecosystem campaign
Malicious open-source packages (TL-2026-3758), also tracked as axios npm supply chain attack, is a high-severity supply-chain compromise, first published 2026-10-16. It is attributed to UNC1069 (North Korea) with medium confidence, affects axios (npm) axios, maps to 19 MITRE ATT&CK techniques (T1027, T1036, T1057), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 2UNC1069
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-3758
- Threat ID
- TL-2026-3758
- Also known as
- axios npm supply chain attack, MAL-2026-2307, MAL-2026-983, Contagious Interview
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- UNC1069, APT38
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, finance, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Malicious open-source packages
Malware and tooling: BeaverTail - S1246, FlexibleFerret, InvisibleFerret - S1245, OtterCookie, SILKBELL, WAVESHAPER
How Malicious open-source packages works
On 2026-03-31 the npm maintainer account for axios (~100M weekly downloads) was hijacked and versions 1.14.1 and 0.30.4 were published with an injected dependency, plain-crypto-js@4.2.1, that dropped a cross-platform RAT (WAVESHAPER.V2) from sfrclak.com. Google attributes the activity to North Korea-nexus UNC1069 (Sapphire Sleet/BlueNoroff). The same FIRST.org analysis highlights the born-bad PyPI cryptominer tensorflow-opt and the Lazarus-linked Contagious Interview campaign (at least 58 packages sharing infrastructure) as evidence that malicious packages need removal/rollback-oriented intelligence rather than CVE-style patch handling.
This record consolidates three malicious-package cases cited in the FIRST.org blog 'Malicious Packages Don't Fit the Vulnerability Intelligence Model' (Jenn Gile, OpenSourceMalware, 2026-04-20). The central argument is that intentionally malicious registry packages have no vulnerable-to-fixed version path: they cannot be patched, only removed from the registry or rolled back, and they need indicator-centric intelligence (registry accounts, emails, domains, C2 endpoints, behavior) rather than CVE/CVSS handling. No CVE or CVSS applies; severity is an analyst assessment under the supply-chain criterion.
Axios compromise (2026-03-31). An attacker hijacked the primary axios maintainer's npm account and published axios 1.14.1 and 0.30.4 within roughly 40 minutes of each other. Both add a dependency on plain-crypto-js@4.2.1, a package staged by the throwaway account nrwise (emails ifstap@proton.me and nrwise@proton.me) about 18 hours before the attack. The version was pinned before it was uploaded, so scanners resolving it earlier saw nothing suspicious. Its postinstall hook runs an obfuscated setup.js (reversed base64 plus XOR layers; Google calls the dropper SILKBELL), which detects the OS and fetches a platform payload from sfrclak.com:8000 (142.11.206.73; URL path /6202033). The payloads are WAVESHAPER.V2 variants: a PowerShell script on Windows (staged as %TEMP%\6202033.ps1, with Run-key persistence via a hidden batch file and a copy of PowerShell as %PROGRAMDATA%\wt.exe), a C++ universal Mach-O on macOS (dropped as /Library/Caches/com.apple.act.mond, executes AppleScript through osascript from /tmp/.XXXXXX.scpt files and unlinks them), and a Python script on Linux (/tmp/ld.py). All beacon every 60 seconds and support kill, rundir, runscript and peinject (in-memory binary execution). After running, the package removes itself and swaps in a clean package.json. The malicious versions were live for about three hours (00:21-03:20 UTC) before npm unpublished them and reverted the latest tag to 1.14.0; automated mirrors such as @depup/axios republished 1.14.1 within 17 minutes. Google GTIG attributes the activity to UNC1069 (financially motivated, North Korea-nexus) based on WAVESHAPER.V2; Microsoft independently tracks it as Sapphire Sleet and CrowdStrike (moderate confidence) as Stardust Chollima. OX Security noted a possible TeamPCP link as unconfirmed.
tensorflow-opt (PyPI). A 'born bad' package that impersonates TensorFlow extensions (dependency-confusion style) and was never legitimate. It stayed on PyPI for years across roughly 31 versions (0.6-0.40) and, when its start method is called, copies a cryptominer into the TensorFlow install directory and mines to a hardcoded wallet. OSV records it as MAL-2026-983 (reported by Kamil Mankowski) and it was removed in late February 2026.
Contagious Interview. A North Korea-linked campaign (the source attributes it to Lazarus Group; other vendors tie it to UNC4034/UNC1069/Sapphire Sleet clusters) in which fake recruiters on LinkedIn, Telegram and Slack lure developers into running trojanized code. The article cites at least 58 npm packages sharing infrastructure; the Cloud Security Alliance reports 1,700+ malicious packages since January 2025 across npm, PyPI, Go, crates.io and Packagist, using a 'factory model' loader ported across languages, deferred execution inside legitimate functions, and a shared staging endpoint (apachelicense.vercel.app). Malware families include BeaverTail, InvisibleFerret, OtterCookie, FlexibleFerret and WAVESHAPER.V2, focused on developer-environment compromise, browser credential and session-token theft, and crypto-wallet exfiltration.
Defensive takeaway: treat any host or CI runner that installed axios 1.14.1/0.30.4 or plain-crypto-js@4.2.1 as fully compromised, rotate all reachable credentials, block the C2, and consume malicious-package feeds (OSV MAL-* records, OpenSourceMalware) keyed on package, account, email and domain indicators.
MITRE ATT&CK techniques used in TL-2026-3758
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059.001 PowerShell; T1059.002 AppleScript; T1059.006 Python; T1059.007 JavaScript
Command and Control
Initial Access
T1078 Valid Accounts; T1195.002 Compromise Software Supply Chain; T1566.003 Spearphishing via Service
Impact
Persistence
T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1555.003 Credentials from Web Browsers
Resource Development
Affected products and versions in Malicious open-source packages
- axios (npm) — axios
Vulnerable versions: 1.14.1; 0.30.4
Fixed in: 1.14.0; 0.30.3 - npm — plain-crypto-js
Vulnerable versions: 4.2.1 - PyPI — tensorflow-opt
Vulnerable versions: 0.6 through 0.40
Remediation for Malicious open-source packages
Patches
- No patch exists; downgrade to axios 1.14.0 or 0.30.3 (or earlier safe releases) and remove plain-crypto-js
Immediate actions
- Identify installs of axios 1.14.1 / 0.30.4 and plain-crypto-js 4.2.1 in lockfiles, node_modules, CI caches and container images
- Treat affected hosts and CI runners as fully compromised; isolate and rebuild rather than clean
- Rotate all credentials, API keys, tokens and SSH keys reachable from affected systems
- Block sfrclak.com and 142.11.206.73 (TCP/8000) at DNS, proxy and firewall; search logs for requests to /6202033
- Hunt for /Library/Caches/com.apple.act.mond, /tmp/ld.py, %TEMP%\6202033.ps1 and %PROGRAMDATA%\wt.exe
Workarounds
- Pin axios to <=1.14.0 / <=0.30.3 via overrides/resolutions
- Remove tensorflow-opt from Python environments and block it at the package proxy
Longer-term hardening
- Enforce a 1-7 day minimum package age before installing newly published versions
- Pin dependencies and commit lockfiles; use npm ci in CI
- Consume malicious-package intelligence (OSV MAL-* records, OpenSourceMalware) keyed on packages, accounts, emails and domains
- Require phishing-resistant MFA and provenance/trusted publishing for registry maintainer accounts
- Restrict install-time lifecycle scripts (ignore-scripts) where feasible
Weaknesses (CWE) in Malicious open-source packages
Timeline of Malicious open-source packages
- Contagious Interview campaign first publicly documented (Palo Alto Unit 42), per the Cloud Security Alliance note
- Contagious Interview package publication accelerates; 1,700+ malicious packages across five ecosystems identified from January 2025 onward
- OSV records tensorflow-opt (PyPI, versions 0.6-0.40) as malicious (MAL-2026-983); package removed from PyPI around 2026-02-24 after surviving for years
- Staging account nrwise (nrwise@proton.me) publishes plain-crypto-js approximately 18 hours before the axios compromise
- Socket, OX Security and other vendors publish analysis of the compromise; OSV records MAL-2026-2307
- Axios maintainer account hijacked; axios 1.14.1 and 0.30.4 published within ~40 minutes with plain-crypto-js@4.2.1 dependency; live roughly 00:21-03:20 UTC before npm unpublished them and reverted latest to 1.14.0
- CSA Singapore issues advisory AD-2026-002; Google GTIG attributes the axios compromise to UNC1069 and Microsoft to Sapphire Sleet
- Contagious Interview expansion to npm, PyPI, Go Modules, crates.io and Packagist publicly disclosed
- FIRST.org publishes 'Malicious Packages Don't Fit the Vulnerability Intelligence Model' citing axios, tensorflow-opt and Contagious Interview
Sources cited for Malicious open-source packages
- Malicious Packages Don't Fit the Vulnerability Intelligence Model (FIRST.org, Jenn Gile)
- Axios Compromised With A Malicious Dependency (OX Security)
- Advisory on Axios Supply Chain Attack via Compromised npm Account (CSA Singapore AD-2026-002)
- Google Attributes Axios npm Supply Chain Attack to North Korea-linked UNC1069 (The Hacker News)
- Google links Axios npm supply chain attack to North Korea-linked APT UNC1069 (Security Affairs)
- Contagious Interview Expands to Five Package Ecosystems (Cloud Security Alliance research note)
- OSV MAL-2026-983: tensorflow-opt
- OSV MAL-2026-2307: axios
- Hiding in Plain Sight: How a Blatant Cryptominer Survived 3 Years on PyPI (Safety)
- Supply chain attack on axios npm package: scope, impact and remediations (Tenable)
Detection coverage for TL-2026-3758
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3758 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3758
4 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.