Fake Teams Update Used to Compromise Axios Maintainer and Push Malicious npm Releases
Summary
A social-engineering campaign compromised an Axios maintainer account and led to malicious npm releases that installed a cross-platform RAT. Google attributes the activity to UNC1069; maintainers removed the releases and reset credentials.
Key points
- Attackers used an impersonated company Slack workspace and a staged Teams call with a fake error to trick an Axios maintainer into installing RAT malware.
- The malware gave attackers remote access to the maintainer’s device and enabled them to obtain Axios npm credentials.
- Malicious Axios versions 1.14.1 and 0.30.4 added the plain-crypto-js dependency, which deployed a RAT on macOS, Windows, and Linux.
- The releases were available for about three hours. Axios maintainers advised treating systems that installed them as compromised and rotating credentials and authentication keys.
- Maintainers said they wiped affected systems, reset credentials, and are implementing changes to reduce the risk of similar attacks.
- Google attributes the activity to North Korean actor UNC1069, citing WAVESHAPER.V2 and infrastructure overlaps.
- Other maintainers of popular Node.js projects also reported similar social-engineering outreach, indicating a coordinated campaign.
Article Details
- Victim Organization
- Axios project
- Victim Domain
- Unknown
- Incident Type
- Social engineering and maintainer-account compromise leading to a software supply-chain attack; malicious Axios releases installed a dependency that deployed a remote access trojan.
- Data Types Exposed
- npm credentials
- Operational Impact
- Malicious Axios versions 1.14.1 and 0.30.4 were available for roughly three hours. Systems that installed them were advised to be considered compromised. Axios maintainers wiped affected systems, reset credentials, and advised rotating keys.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsCompromised npm credentials were used to publish the malicious releases.T1195.001 · Compromise Software Dependencies and Development ToolsA compromised maintainer account was used to publish Axios releases containing a malicious dependency.T1204.002 · Malicious FileThe maintainer was socially engineered into installing a fake update that deployed RAT malware.
People
Jason SaaymanAxios lead maintainer targeted by the social engineering campaign; his account was compromised and used to publish malicious releases.Pelle WessmanOpen-source maintainer targeted by the same campaign; he refused to install the offered app or run a Curl command and shared details of the attempted attack.
Threat Actors
Malware
WAVESHAPERGoogle TAG attributed the operation to North Korean actor UNC1069 using WAVESHAPER.V2, and maintainers have wiped affected systems, reset credentials, and advised rotating all keys.WAVESHAPER.V2Google TAG attributed the operation to North Korean actor UNC1069 using WAVESHAPER.V2, and maintainers have wiped affected systems, reset credentials, and advised rotating all keys.
Products
AxiosThe Axios maintainers published a post-mortem showing a targeted social engineering campaign that led to malicious Axios npm releases (1.14.1 and 0.30.4) which injected a dependency, plain-crypto-js, that deployed aMicrosoft TeamsAttackers used a convincing fake company presence on Slack and staged Microsoft Teams calls to socially engineer maintainers.Node.jsGoogle TAG links the campaign to UNC1069 and WAVESHAPER.V2, and similar outreach targeted multiple high-impact Node.js maintainers.npmpublished a post-mortem showing a targeted social engineering campaign that led to malicious Axios npm releases (1.14.1 and 0.30.4) which injected a dependency, plain-crypto-js, that deployed a cross-platformSlackAttackers used a convincing fake company presence on Slack and staged Microsoft Teams calls to socially engineer maintainers.