UNC1069-Linked Social Engineering Compromises Axios npm Maintainer
Summary
Axios maintainer Jason Saayman confirmed attackers used targeted social engineering to steal his npm credentials and publish two trojanized releases containing WAVESHAPER.V2. The article links the campaign’s tradecraft to UNC1069.
Key points
- Attackers impersonated a company founder, used a cloned Slack workspace, and arranged a fake Microsoft Teams meeting with the maintainer.
- A fake update prompt during the call led to deployment of a remote access trojan, which enabled credential theft.
- The attackers published trojanized Axios versions 1.14.1 and 0.30.4 containing the WAVESHAPER.V2 implant.
- The report says the campaign's tradecraft overlaps with UNC1069 and BlueNoroff activity; Kaspersky tracked related activity as GhostCall.
- The article describes CosmicDoor and SilentSiphon as components of related attack activity, not as implants identified in the trojanized Axios releases.
- The maintainer recommended resetting devices and credentials, using immutable releases and OIDC publishing, and improving GitHub Actions practices.
- Axios's reported nearly 100 million weekly downloads could increase downstream exposure to poisoned releases.
Article Details
- Victim Organization
- Axios npm package project
- Incident Type
- Targeted social engineering leading to theft of npm account credentials and publication of trojanized Axios package versions
- Data Types Exposed
- npm account credentials
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Two trojanized Axios versions, 1.14.1 and 0.30.4, were published. The article describes a potential downstream supply-chain risk but reports no confirmed downstream impact.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
People
Ahmad NassriSocket representative who commented on the exposure risks created by dependency resolution after the Axios compromise.Jason SaaymanAxios maintainer who described the targeted social engineering incident and confirmed that attackers stole the npm credentials used to publish the trojanized package versions.Taylor MonahanSecurity researcher who commented on the attackers’ historical social engineering and account-takeover activity and the shift toward targeting open-source maintainers.
Threat Actors
BlueNoroffThe article says the campaign’s tradecraft overlapped with tradecraft associated with BlueNoroff; it does not establish BlueNoroff’s direct responsibility for this compromise.UNC1069The article attributes the targeted social engineering and Axios supply-chain compromise to North Korean-linked threat actors tracked as UNC1069.
Malware
CosmicDooras part of the attack chain is a Nim-based macOS backdoor (or a Go variant written for Windows) called CosmicDoor that delivers a comprehensive stealer suite dubbed SilentSiphon to capture credentials from webSilentSiphona Go variant written for Windows) called CosmicDoor that delivers a comprehensive stealer suite dubbed SilentSiphon to capture credentials from web browsers and password managers, and secrets associated with GitHub,WAVESHAPER.V2The compromise deployed a remote access implant called WAVESHAPER.V2 and underscores the massive supply-chain risk posed by attacks on popular open-source maintainers.
Products
AxiosNorth Korean-linked threat actors tracked as UNC1069 used a highly targeted social engineering campaign to steal the Axios maintainer’s credentials and publish trojanized versions of the package.Microsoft TeamsAttackers impersonated a legitimate company’s founder, created a cloned Slack workspace, and scheduled a fake Microsoft Teams meeting.npmThe maintainer of the Axios npm package has confirmed that the supply chain compromise was the result of a highly-targeted social engineering campaign orchestrated by North Korean threat actors tracked as UNC1069.SlackAttackers impersonated a legitimate company’s founder, created a cloned Slack workspace, and scheduled a fake Microsoft Teams meeting.