Google Links Axios npm Supply-Chain Attack to North Korean-Linked UNC1069
Summary
Researchers attributed malicious axios npm releases to North Korean-linked UNC1069. The releases used a hijacked maintainer account to install a multi-stage RAT, but the full scope and downstream impact remain unclear.
Key points
- Socket and StepSecurity reported that attackers hijacked the lead axios maintainer’s npm account and published two malicious package versions.
- The releases added a dependency that installed a multi-stage RAT affecting Windows, macOS, and Linux.
- The RAT could execute commands, exfiltrate system data, and persist; it then reportedly deleted itself and restored legitimate axios files to evade detection.
- Google Threat Intelligence Group and other researchers attributed the attack to North Korean-linked UNC1069; researchers noted similarities to the WAVESHAPER malware.
- Google said the incident’s full scope was unclear, while experts warned that axios’s popularity could produce broad downstream effects.
- A Kaseya security leader said the malicious code was live for almost three hours before discovery.
Article Details
- Event Type
- Software supply-chain attack involving malicious axios npm releases
- Impact
- Attackers used a hijacked axios maintainer npm account to publish two malicious versions that added a dependency installing a multi-stage RAT. The malware could execute commands, exfiltrate system data, and persist on Windows, macOS, and Linux before deleting itself and restoring legitimate axios files. The full impact remains unclear; the article reports the malicious releases were live for almost three hours and notes the package's roughly 100 million weekly downloads could create broad downstream exposure.
MITRE ATT&CK
People
Charles CarmakalMandiant CTO who warned that stolen secrets from recent attacks could enable further compromises, ransomware, extortion, and cryptocurrency theft.John HultquistChief analyst at Google Threat Intelligence Group; commented on the incident's relationship to other supply-chain attacks and the potential reach of the compromised package.Mike PugliaSecurity leader at Kaseya who said the attacker compromised the axios maintainer account and estimated that a typical day could have exposed tens of thousands of organizations.
Threat Actors
Malware
Vendors
Google Threat Intelligence GroupGoogle Threat Intelligence Group and other researchers attribute the axios compromise to North Korean-linked UNC1069.SentinelOneSentinelOne found the same group using macOS-based malware in attacks dating back to 2023.SocketSecurity companies Socket and StepSecurity confirmed the packages were malicious and traced the incident back to the hijacking of the lead axios maintainer’s npm account.StepSecuritySecurity companies Socket and StepSecurity confirmed the packages were malicious and traced the incident back to the hijacking of the lead axios maintainer’s npm account.
Products
AxiosNorth Korean–linked hackers attributed to UNC1069 compromised the widely used axios npm package in a supply chain attack that published malicious releases, deploying a multi-stage RAT across Windows, macOS, and Linux.LinuxNorth Korean–linked hackers attributed to UNC1069 compromised the widely used axios npm package in a supply chain attack that published malicious releases, deploying a multi-stage RAT across Windows, macOS, and Linux.macOSNorth Korean–linked hackers attributed to UNC1069 compromised the widely used axios npm package in a supply chain attack that published malicious releases, deploying a multi-stage RAT across Windows, macOS, and Linux.Microsoft WindowsNorth Korean–linked hackers attributed to UNC1069 compromised the widely used axios npm package in a supply chain attack that published malicious releases, deploying a multi-stage RAT across Windows, macOS, and Linux.npmNorth Korean–linked hackers attributed to UNC1069 compromised the widely used axios npm package in a supply chain attack that published malicious releases, deploying a multi-stage RAT across Windows, macOS, and Linux.