Axios npm Supply Chain Attack (March 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·yWn5pS…dfKzSummary
On March 31, 2026, two backdoored releases of the Axios JavaScript HTTP client library (versions 1.14.1 and 0.30.4) were published to the npm registry via a compromised maintainer account, injecting a malicious dependency that delivered the WAVESHAPER.V2 cross-platform remote access trojan to macOS, Windows, and Linux systems. The malicious packages were live for approximately three hours before removal; the attack has been attributed to UNC1069 (also tracked as Sapphire Sleet), a North Korean state-sponsored threat actor. CISA issued a formal advisory on April 20, 2026.
Connected Entities
2 entities · 6 linked investigations- Sapphire Sleet / UNC1069→mentioned with→Axios npm Supply Chain Attack (March 2026)(80%)
- Axios npm Supply Chain Attack (March 2026)→mentioned with→Sapphire Sleet / UNC1069(80%)
Connected Through
2 shared actors · 6 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Sapphire Sleet / UNC1069organization
- □Axios npm Supply Chain Attack (March 2026)organization
Timeline(12 events)
30 March 2026
Plain-crypto-js@4.2.0 (pre-staging, non-malicious) published to npm at 05:57 UTC. Malicious plain-crypto-js@4.2.1 published at 23:59 UTC.
The Hacker News31 March 2026
Malicious axios@1.14.1 published to npm at 00:21 UTC; axios@0.30.4 published at approximately 01:00 UTC. Both versions inject plain-crypto-js@4.2.1 to deliver the WAVESHAPER.V2 RAT.
Axios GitHub Post-Mortem (Issue #10636)31 March 2026
Community member and collaborator DigitalBrainJS opens a deprecation PR and contacts npm security directly at approximately 01:38 UTC, initiating takedown.
Axios GitHub Post-Mortem (Issue #10636)31 March 2026
Malicious axios versions removed from npm registry at 03:15 UTC; plain-crypto-js removed at 03:29 UTC. Total attack window: approximately 2 hours 54 minutes.
Axios GitHub Post-Mortem (Issue #10636)April 2026
Microsoft Threat Intelligence publicly attributes the compromise to Sapphire Sleet, a North Korean state-sponsored threat actor, and publishes mitigation guidance.
Microsoft Security BlogApril 2026
Unit 42 (Palo Alto Networks) publishes initial threat brief with IOCs, malware analysis, and remediation guidance.
Unit 42 — Palo Alto NetworksApril 2026
Axios lead maintainer jasonsaayman publicly confirms the compromise was the result of a targeted multi-week social engineering campaign involving a fake corporate identity and a malicious software installer delivered during an MS Teams meeting.
Cybersecurity NewsApril 2026
Help Net Security reports North Korean hackers linked to the compromise, citing Google Threat Intelligence and Mandiant attribution to UNC1069.
Help Net Security9 April 2026
Unit 42 adds Advanced Threat Prevention detection coverage for the WAVESHAPER.V2 variants.
Unit 42 — Palo Alto Networks13 April 2026
Unit 42 issues clarifications on Windows RAT execution mechanics; Cortex AgentiX coverage added.
Unit 42 — Palo Alto Networks20 April 2026
CISA issues formal advisory alerting organizations to the supply chain compromise, with detailed remediation steps including credential rotation, C2 blocking, and npm hardening guidance.
CISA19 May 2026
Unit 42 formally closes active threat monitoring for this incident.
Unit 42 — Palo Alto NetworksDecision Log
- hash: 73ZvoqJ7AHDtpQaK9kzHc1UBshxcFRkbbfKTqhanFHAv
This investigation is cryptographically anchored to the Solana blockchain (1 event). 19 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/19/2026, 11:09:34 PM
last updated: 7/27/2026, 10:56:26 AM
3 viewsavoid.net — verified advice for a post-truth world