Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #6[disputed][awaiting moderator]in section: Regulatory and Government Response

   “Unit 42 published 23 SHA256 hashes for malware variants in its threat brief.”

   reviewerUnit 42 published 23 SHA256 hashesThe count is 24 unique (30 listed), not 23. The count came from a summarising fetch tool, so the exact figure is moderately confident.
   Proposed correction (not yet applied)

   Unit 42 published 24 unique SHA256 hashes for malware variants in its threat brief.
   citedunit42.paloaltonetworks.com/axios-supply-chain-attack/

No source the reviewer could reach confirms or contradicts the claim.

1. #2[unverifiable][awaiting moderator]in the timeline

   “Malicious plain-crypto-js@4.2.1 published at 23:59 UTC.”

   reviewerMalicious plain-crypto-js@4.2.1 was published at 23:59 UTC on March 30The 4.2.0 time is confirmed; I did not find the 23:59 UTC figure for 4.2.1 in the sources I read. The cited Hacker News article was not fetched.
   citedthehackernews.com/2026/03/axios-supply-c…ushes-cross.html
2. #13[unverifiable][awaiting moderator]in section: Maintainer Account Compromise and Social Engineering

   “Saayman later described the operation as 'extremely well co-ordinated, looked legit and was done in a professional manner.'”

   reviewerCybersecurity News article confirms maintainer statements (Slack workspace, Teams meeting, 'full unilateral control')The fetch returned no content, so the quotations and the Slack/Teams details could not be checked. This is a fetch failure, not evidence against the claim.
   citedcybersecuritynews.com/axios-maintainer-c…-npm-compromise/thehackernews.com/2026/04/unc1069-social…ng-of-axios.html

The cited evidence supports part of the claim but not all of it.

1. #3[partially supported][awaiting moderator]in section: Incident Overview

   “Axios is one of the most widely used JavaScript HTTP client libraries, receiving over 100 million weekly downloads and listed as a direct or transitive dependency in more than 174,000 public npm packages.”

   reviewerAxios has over 100 million weekly downloads and is a dependency of more than 174,000 npm packagesDownload figure varies by source (70M to 100M+). The 174,000 figure appears in secondary reporting (CSO Online and others) but not in the cited primary sources. The page should attribute these figures and not present them as settled.
   citedunit42.paloaltonetworks.com/axios-supply-chain-attack/
2. #4[partially supported][awaiting moderator]in section: Scale and Blast Radius

   “Axios is estimated to be present in approximately 80 percent of cloud and developer environments.”

   reviewerAxios is present in approximately 80 percent of cloud and developer environmentsSearch results attribute the 80% estimate to Wiz, which is not cited on the page. Unit 42 does not state it.
   citedunit42.paloaltonetworks.com/axios-supply-chain-attack/socradar.io/blog/axios-npm-supply-chain-…2026-ciso-guide/
3. #5[partially supported][awaiting moderator]in section: Scale and Blast Radius

   “No confirmed count of compromised systems has been publicly released by any government or vendor as of the date of this report.”

   reviewerNo confirmed count of compromised systems has been publicly released by any vendorVendor telemetry estimates exist (Wiz about 3% of environments; one report of 135 systems), so the absolute statement is too strong. Based on search summaries only, not fetched pages.
   citedunit42.paloaltonetworks.com/axios-supply-chain-attack/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the timeline

   “Malicious axios@1.14.1 published to npm at 00:21 UTC; axios@0.30.4 published at approximately 01:00 UTC.”

   reviewerAxios was published malicious versions 1.14.1 and 0.30.4 on March 31, 2026, with timings 00:21, ~01:00, removal 03:15 UTC, window ~2h54mPublish, detection and removal times match the official post-mortem.
   citedgithub.com/axios/axios/issues/10636
2. #7[confirmed][no action needed]in section: Threat Actor Attribution

   “Microsoft Threat Intelligence publicly attributed the attack on April 1, 2026, to Sapphire Sleet, a North Korean state actor Microsoft has tracked in prior campaigns against cryptocurrency platforms, financial institutions, and technology supply chains.”

   reviewerMicrosoft publicly attributed the attack to Sapphire Sleet on April 1, 2026The attribution and date are confirmed. The 'prior campaigns' description was not checked.
   citedwww.microsoft.com/en-us/security/blog/20…hain-compromise/
3. #8[confirmed][no action needed]in section: Threat Actor Attribution

   “Google Threat Intelligence Group and Mandiant attributed the same attack to UNC1069, a financially motivated North Korea-nexus threat cluster active since at least 2018.”

   reviewerGTIG/Mandiant attributed the attack to UNC1069 based on WAVESHAPER.V2, an AstrillVPN node and adjacent ASN infrastructureMatches the GTIG post. Note the page's summary says 'also tracked as Sapphire Sleet', which Microsoft frames as overlap.
   citedcloud.google.com/blog/topics/threat-inte…xios-npm-package
4. #9[confirmed][no action needed]in section: Cryptocurrency and Developer Credential Risk

   “CISA did not assign a CVE number in its alert and did not make an independent threat actor attribution statement.”

   reviewerCISA alert of April 20, 2026 advised downgrade to 1.14.0 or 0.30.3, made no CVE and no attributionThe alert contents match. The IOC section credits CISA among publishers of the IP address and hashes, but the CISA alert lists only the domain, versions and path.
   citedwww.cisa.gov/news-events/alerts/2026/04/…-package-manager
5. #10[confirmed][no action needed]in section: Maintainer Account Compromise and Social Engineering

   “The attacker subsequently changed the registered email on the npm account to ifstap@proton.me before publishing the malicious releases.”

   reviewerThe attacker changed the registered email on the npm account to ifstap@proton.meCorroborated by multiple vendor write-ups per search results. Not in the cited post-mortem as fetched.
   citedgithub.com/axios/axios/issues/10636
6. #11[confirmed][no action needed]in section: Maintainer Account Compromise and Social Engineering

   “A parallel, nearly identical social engineering attempt was reportedly made against another Axios collaborator (voxpelli) weeks earlier, framed as a podcast invitation; that attempt was rebuffed when the target refused to install software.”

   reviewerVoxpelli was targeted by a similar social engineering attempt framed as a podcast invitation and refused to install softwareThe 'weeks earlier' timing was not checked.
   citedgithub.com/axios/axios/issues/10636
7. #12[confirmed][no action needed]in the timeline

   “Unit 42 formally closes active threat monitoring for this incident.”

   reviewerUnit 42 updated its brief on April 9 and April 13 and stopped monitoring on May 19, 2026Dates match the brief.
   citedunit42.paloaltonetworks.com/axios-supply-chain-attack/