# Malicious open-source packages: axios npm account hijack (plain-crypto-js / WAVESHAPER.V2), tensorflow-opt PyPI miner, and Contagious Interview multi-ecosystem campaign

> On 2026-03-31 the npm maintainer account for axios (~100M weekly downloads) was hijacked and versions 1.14.1 and 0.30.4 were published with an injected dependency, plain-crypto-js@4.2.1, that dropped a cross-platform RAT (WAVESHAPER.V2) from sfrclak.com. Google attributes the activity to North Korea-nexus UNC1069 (Sapphire Sleet/BlueNoroff). The same FIRST.org analysis highlights the born-bad PyPI cryptominer tensorflow-opt and the Lazarus-linked Contagious Interview campaign (at least 58 packages sharing infrastructure) as evidence that malicious packages need removal/rollback-oriented intelligence rather than CVE-style patch handling.

- **Published:** 2026-10-16T16:46:19Z
- **Last reviewed:** 2026-10-16T16:46:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3758
- **ID:** TL-2026-3758
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** UNC1069 (North Korea)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record consolidates three malicious-package cases cited in the FIRST.org blog 'Malicious Packages Don't Fit the Vulnerability Intelligence Model' (Jenn Gile, OpenSourceMalware, 2026-04-20). The central argument is that intentionally malicious registry packages have no vulnerable-to-fixed version path: they cannot be patched, only removed from the registry or rolled back, and they need indicator-centric intelligence (registry accounts, emails, domains, C2 endpoints, behavior) rather than CVE/CVSS handling. No CVE or CVSS applies; severity is an analyst assessment under the supply-chain criterion.

Axios compromise (2026-03-31). An attacker hijacked the primary axios maintainer's npm account and published axios 1.14.1 and 0.30.4 within roughly 40 minutes of each other. Both add a dependency on plain-crypto-js@4.2.1, a package staged by the throwaway account nrwise (emails ifstap@proton.me and nrwise@proton.me) about 18 hours before the attack. The version was pinned before it was uploaded, so scanners resolving it earlier saw nothing suspicious. Its postinstall hook runs an obfuscated setup.js (reversed base64 plus XOR layers; Google calls the dropper SILKBELL), which detects the OS and fetches a platform payload from sfrclak.com:8000 (142.11.206.73; URL path /6202033). The payloads are WAVESHAPER.V2 variants: a PowerShell script on Windows (staged as %TEMP%\6202033.ps1, with Run-key persistence via a hidden batch file and a copy of PowerShell as %PROGRAMDATA%\wt.exe), a C++ universal Mach-O on macOS (dropped as /Library/Caches/com.apple.act.mond, executes AppleScript through osascript from /tmp/.XXXXXX.scpt files and unlinks them), and a Python script on Linux (/tmp/ld.py). All beacon every 60 seconds and support kill, rundir, runscript and peinject (in-memory binary execution). After running, the package removes itself and swaps in a clean package.json. The malicious versions were live for about three hours (00:21-03:20 UTC) before npm unpublished them and reverted the latest tag to 1.14.0; automated mirrors such as @depup/axios republished 1.14.1 within 17 minutes. Google GTIG attributes the activity to UNC1069 (financially motivated, North Korea-nexus) based on WAVESHAPER.V2; Microsoft independently tracks it as Sapphire Sleet and CrowdStrike (moderate confidence) as Stardust Chollima. OX Security noted a possible TeamPCP link as unconfirmed.

tensorflow-opt (PyPI). A 'born bad' package that impersonates TensorFlow extensions (dependency-confusion style) and was never legitimate. It stayed on PyPI for years across roughly 31 versions (0.6-0.40) and, when its start method is called, copies a cryptominer into the TensorFlow install directory and mines to a hardcoded wallet. OSV records it as MAL-2026-983 (reported by Kamil Mankowski) and it was removed in late February 2026.

Contagious Interview. A North Korea-linked campaign (the source attributes it to Lazarus Group; other vendors tie it to UNC4034/UNC1069/Sapphire Sleet clusters) in which fake recruiters on LinkedIn, Telegram and Slack lure developers into running trojanized code. The article cites at least 58 npm packages sharing infrastructure; the Cloud Security Alliance reports 1,700+ malicious packages since January 2025 across npm, PyPI, Go, crates.io and Packagist, using a 'factory model' loader ported across languages, deferred execution inside legitimate functions, and a shared staging endpoint (apachelicense.vercel.app). Malware families include BeaverTail, InvisibleFerret, OtterCookie, FlexibleFerret and WAVESHAPER.V2, focused on developer-environment compromise, browser credential and session-token theft, and crypto-wallet exfiltration.

Defensive takeaway: treat any host or CI runner that installed axios 1.14.1/0.30.4 or plain-crypto-js@4.2.1 as fully compromised, rotate all reachable credentials, block the C2, and consume malicious-package feeds (OSV MAL-* records, OpenSourceMalware) keyed on package, account, email and domain indicators.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1078 Valid Accounts
- T1566.003 Spearphishing via Service
- T1583.001 Domains
- T1059.007 JavaScript
- T1059.001 PowerShell
- T1059.006 Python
- T1059.002 AppleScript
- T1547.001 Registry Run Keys / Startup Folder
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 File Deletion
- T1036 Masquerading
- T1620 Reflective Code Loading
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1057 Process Discovery
- T1071.001 Web Protocols
- T1496 Resource Hijacking

## Sources

- [Malicious Packages Don't Fit the Vulnerability Intelligence Model (FIRST.org, Jenn Gile)](https://www.first.org/blog/20260420-Malicious-Packages-Dont-Fit)
- [Axios Compromised With A Malicious Dependency (OX Security)](https://www.ox.security/blog/axios-compromised-with-a-malicious-dependency/)
- [Advisory on Axios Supply Chain Attack via Compromised npm Account (CSA Singapore AD-2026-002)](https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-002/)
- [Google Attributes Axios npm Supply Chain Attack to North Korea-linked UNC1069 (The Hacker News)](https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html)
- [Google links Axios npm supply chain attack to North Korea-linked APT UNC1069 (Security Affairs)](https://securityaffairs.com/190256/security/google-links-axios-npm-supply-chain-attack-to-north-korea-linked-apt-unc1069.html)
- [Contagious Interview Expands to Five Package Ecosystems (Cloud Security Alliance research note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-dprk-contagious-interview-cross-ecosystem/)
- [OSV MAL-2026-983: tensorflow-opt](https://osv.dev/vulnerability/MAL-2026-983)
- [OSV MAL-2026-2307: axios](https://osv.dev/vulnerability/MAL-2026-2307)
- [Hiding in Plain Sight: How a Blatant Cryptominer Survived 3 Years on PyPI (Safety)](https://www.getsafety.com/blog-posts/malicious-packages-hide-pypi)
- [Supply chain attack on axios npm package: scope, impact and remediations (Tenable)](https://www.tenable.com/blog/supply-chain-attack-on-axios-npm-package-scope-impact-and-remediations)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3758