Inside the Axios npm Attack: How North Korean Hackers Hit

On March 31, 2026, between 00:21 and 03:20 UTC, one of the most widely used JavaScript libraries on the planet turned hostile. Axios — downloaded roughly 100 million times per week and embedded in about 80% of cloud environments — was compromised by North Korean hackers who slipped a remote access trojan into two published versions.

The attack lasted just under three hours. In that window, an estimated 600,000 installs of the poisoned package occurred. Security researchers at Elastic Security Labs caught the anomaly through automated supply-chain monitoring and immediately filed a GitHub Security Advisory. The malicious versions were pulled. But the damage — and the lessons — run far deeper than a quick fix can address.

How UNC1069 Pulled It Off

Google’s Threat Intelligence team formally attributed the attack to UNC1069, a financially motivated North Korean threat group previously linked to cryptocurrency theft campaigns. Their method was not a zero-day exploit or a brute-force breach. It was social engineering — patient, targeted, and disturbingly effective.

The attackers built an entire fake company. They created a convincing Slack workspace, populated LinkedIn with fake employee profiles, and constructed a believable digital presence over several weeks. Then they approached Jason Saayman, the lead maintainer of the Axios project, posing as the founder of a well-known, legitimate firm.

Saayman later confirmed the social engineering was “specifically tailored” to him. The attackers studied his background, his interests, and his role in the open-source community. Over time, they built trust. Eventually, they tricked him into installing malware on his machine, which gave them access to his npm publishing credentials.

With those credentials, the attacker published two backdoored versions — Axios 1.14.1 and 0.30.4 — each containing a malicious dependency called “plain-crypto-js.”

The Malware: SILKBELL and WAVESHAPER.V2

The technical sophistication of the payload matched the social engineering effort. The “plain-crypto-js” package acted as a delivery vehicle for an obfuscated JavaScript dropper called SILKBELL. This dropper, hidden in a file called “setup.js,” executed during the npm postinstall phase — meaning it ran automatically whenever someone installed or updated Axios.

SILKBELL detected the victim’s operating system and fetched the appropriate next-stage payload from a remote command-and-control server. The final payload was WAVESHAPER.V2, an updated version of a C++ implant that UNC1069 has used in previous attacks against cryptocurrency exchanges.

The malware was cross-platform by design:

• Windows systems received a PowerShell-based backdoor
• macOS machines got a compiled C++ Mach-O binary
• Linux servers were hit with a Python-based backdoor

Each variant established persistent remote access, allowing the attackers to exfiltrate data, monitor activity, and potentially move laterally through corporate networks.

Why This Attack Matters Beyond Axios

The Axios compromise is not an isolated incident. It is the latest and most visible example of a growing trend: state-sponsored attackers targeting the open-source supply chain. And it exposes structural weaknesses that the software industry has been slow to address.

Single points of failure. Axios, a package depended on by millions of applications worldwide, was maintained by a small team. One compromised account was enough to poison the entire ecosystem. This is not unique to Axios — many critical open-source packages rely on a handful of unpaid volunteers.

npm’s trust model. The npm registry operates on a trust-based publishing system. Once a maintainer has publishing rights, there are limited automated checks on what they push. Version 1.14.1 passed through without automated malware scanning catching the embedded dropper before thousands of developers had already installed it.

The cryptocurrency connection. UNC1069’s ultimate goal was financial. North Korea has stolen billions in cryptocurrency over the past decade to fund its weapons programs. Supply chain attacks offer a particularly efficient vector — instead of targeting individual companies, attackers can compromise a single upstream dependency and reach thousands of targets simultaneously.

The Industry Response

The response was swift but revealed how reactive the ecosystem remains. Elastic Security Labs detected the compromise within hours through automated monitoring. GitHub and npm removed the malicious versions. The SANS Institute held an emergency briefing. Security firms including Malwarebytes, SOCRadar, and StepSecurity published detailed analyses and indicators of compromise.

npm announced it would accelerate plans for mandatory provenance attestation, which would cryptographically link published packages to their source code repositories and build systems. GitHub has also expanded its secret scanning and dependency review capabilities.

But these measures are largely after-the-fact improvements. The fundamental challenge remains: how do you secure a system built on trust when state-sponsored actors are willing to invest months in social engineering a single maintainer?

What Developers Should Do Right Now

If you use Axios in any project, here are the immediate steps security experts recommend:

• Check your lockfiles. Look for axios versions 1.14.1 or 0.30.4, or any reference to “plain-crypto-js.” If found, remove them immediately and run a full dependency audit.
• Scan for indicators of compromise. Elastic Security Labs and SOCRadar have published detailed IOC lists including file hashes, command-and-control domains, and behavioral signatures for WAVESHAPER.V2.
• Enable npm audit signatures. Verify that your installed packages match the expected provenance. Tools like Socket.dev and StepSecurity’s Harden-Runner can add automated supply chain checks to your CI/CD pipeline.
• Pin your dependencies. Avoid using loose version ranges (^1.x.x) for critical packages. Pinning exact versions and using a lockfile gives you control over when updates are applied.
• Monitor maintainer activity. Services like OpenSSF Scorecard evaluate the security practices of open-source projects. Use these scores as one factor when choosing dependencies.

A Pattern That Keeps Repeating

The Axios incident joins a growing list of supply-chain attacks that have rattled the tech world. The SolarWinds breach in 2020 targeted proprietary software. The Log4Shell vulnerability in 2021 exposed the fragility of open-source dependencies. The xz Utils backdoor in 2024 showed how a patient attacker could embed themselves in a project over years.

Each attack has been more sophisticated than the last. UNC1069’s campaign against Axios combined social engineering, fake corporate identities, cross-platform malware, and a deep understanding of the npm ecosystem. It was not opportunistic — it was a calculated operation by a well-resourced state actor.

The open-source community faces a difficult reckoning. The software that powers the modern internet is overwhelmingly maintained by small teams and individuals, often without compensation. Asking these maintainers to also defend against nation-state attackers is unrealistic without significant investment from the companies that profit from their work.

Organizations like the Open Source Security Foundation (OpenSSF) and the Alpha-Omega project are working to direct resources toward critical open-source infrastructure. But progress has been incremental, and the attackers are not waiting.

What Comes Next

The Axios attack will accelerate several trends already underway. Expect more organizations to adopt software bills of materials (SBOMs) that track every component in their applications. Expect npm and other registries to implement stricter publishing controls, potentially including mandatory multi-factor authentication and time-delayed publishing for maintainer accounts.

Most importantly, expect this conversation to shift from “if” to “when” for the next major supply chain compromise. The question is no longer whether open-source infrastructure is a target — it clearly is. The question is whether the industry will invest enough in securing it before the next attack hits.

For now, check your lockfiles. Update your dependencies. And pay close attention to where your code really comes from.

Related: After Testing 8 AI Code Security Tools