Threat Firms Attribute Axios npm Supply-Chain Attack to Lazarus Group
Summary
Threat firms attribute the malicious plain-crypto-js dependency in axios npm versions 1.14.1 and 0.30.4 to Lazarus/UNC1069. Its postinstall dropper deployed WAVESHAPER.V2; Huntress found about 135 compromised devices, while total impact remains unclear.
Key points
- Between 00:21 and 03:20 UTC on March 31, plain-crypto-js was added to axios npm versions 1.14.1 and 0.30.4.
- The dependency's postinstall hook ran an obfuscated JavaScript dropper tracked as SILKBELL, which delivered platform-specific payloads.
- The payloads deployed the WAVESHAPER.V2 backdoor on Windows, macOS, and Linux; the reported command-and-control address was sfrclak[.]com:8000/6202033.
- GTIG, Mandiant, and ThreatBook attributed the operation to UNC1069/Lazarus Group; the article cites similarities to earlier WAVESHAPER malware and infrastructure overlap.
- The affected axios releases were removed within hours. Huntress identified approximately 135 compromised devices, but the total number affected remains under investigation.
- The article advises teams that ran npm install during the affected window to check for payload artifacts, remove plain-crypto-js, downgrade axios, audit CI/CD logs, rotate credentials where artifacts are found, and block egress to sfrclak[.]com.
Article Details
- Victim Organization
- Axios package and associated maintainer account
- Incident Type
- Software supply-chain attack involving malicious dependencies inserted into Axios npm releases
- Incident Date
- 2026-03-31
- Affected Records
- Huntress identified approximately 135 compromised devices; the true number affected remains under investigation.
- Operational Impact
- The malicious dependency ran an obfuscated dropper through an npm postinstall hook and deployed platform-specific backdoor payloads. Execution was observed in 3% of affected environments. The article advises treating npm installs run during the affected window as potentially compromised.
- Ransom Or Extortion
- Mandiant CTO Charles Carmakal warned that stolen secrets could enable future ransomware and extortion events. The article reports no ransom demand or extortion tied directly to this incident.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sfrclak[.]com | Command-and-control domain contacted by the WAVESHAPER.V2 backdoor. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe JavaScript dropper was described as obfuscated.T1059.007 · JavaScriptAn obfuscated JavaScript dropper executed through the dependency's postinstall hook.T1070.004 · File DeletionAfter deploying payloads, the dropper attempted to delete itself as part of cleanup.T1082 · System Information DiscoveryThe WAVESHAPER.V2 backdoor collects system information.T1083 · File and Directory DiscoveryThe WAVESHAPER.V2 backdoor enumerates directories.T1105 · Ingress Tool TransferThe dropper downloaded platform-specific payloads.T1195.001 · Compromise Software Dependencies and Development ToolsA malicious dependency was inserted into Axios npm releases, compromising the software supply chain.
People
Charles CarmakalMandiant CTO who described the potential downstream risks of the attack and said Mandiant was aware of hundreds of thousands of stolen credentials across attacks by varied actors.John HultquistGTIG Chief Analyst who commented on North Korean hackers' history of supply-chain attacks and the still-unclear breadth of the incident.
Threat Actors
Lazarus GroupThreatBook and other cited threat intelligence firms attributed the campaign to Lazarus Group; the article presents this as third-party attribution based on tracking data and infrastructure overlap.UNC1069Google Threat Intelligence Group attributed the operation to UNC1069, describing it as a North Korea-nexus group and citing WAVESHAPER.V2's relationship to a backdoor previously used by the group and infrastructure overlap.
Malware
SILKBELLand 0.30.4) on March 31, using a postinstall hook that executed an obfuscated dropper (tracked as SILKBELL) to deploy platform-specific payloads.WAVESHAPER.V2ThreatBook) attributed the campaign to North Korea’s Lazarus Group/UNC1069, which deployed the WAVESHAPER.V2 backdoor contacting sfrclak[.]com, and defenders should treat any npm install run between 00:21–03:20
Products
AxiosA supply chain attack inserted a malicious dependency, plain-crypto-js, into axios npm releases (1.14.1 and 0.30.4) on March 31, using a postinstall hook that executed an obfuscated dropper (tracked as SILKBELL) tonpmA supply chain attack inserted a malicious dependency, plain-crypto-js, into axios npm releases (1.14.1 and 0.30.4) on March 31, using a postinstall hook that executed an obfuscated dropper (tracked as SILKBELL) to