Loading story…
A suspected North Korean threat actor compromised a maintainer account for the widely used open-source package Axios and pushed malicious updates for about three hours in a software supply-chain attack, according to reporting from CNN, NK News, and security researchers cited by both outlets. Google Threat Intelligence Group and Mandiant linked the operation to North Korean actors, saying the attackers likely sought information to support follow-on intrusions and cryptocurrency theft. Axios is broadly embedded in web applications and server-to-server communications, raising concern that the compromise could affect organizations across healthcare, finance, and cryptocurrency-related sectors.
Incident responders said the known impact was still developing, with Huntress identifying roughly 135 compromised devices across about 12 companies while warning the downstream victim count could grow substantially because Axios is used by thousands of enterprises. Researchers said the campaign fits Pyongyang’s established pattern of using cyber operations for revenue generation and strategic access, and warned that determining the full scope of exposure and any secondary compromises could take months.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence Group disclosed the Axios compromise the day after the breach was reported to have occurred, and Mandiant attributed the activity to a suspected North Korean group. Huntress said it had identified about 135 compromised devices across roughly 12 companies, with the potential impact expected to grow because Axios is widely used.
A suspected North Korean threat actor compromised the account of a maintainer of the open-source Axios package and used it for about three hours to distribute malicious updates. The operation was assessed as a software supply-chain attack likely intended to support future intrusions and cryptocurrency theft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
nknews.org
Open sourcecnn.com
Open sourcereverse.put.as
Open sourcephrack.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers hijacked the npm account of Axios maintainer Jason Saayman and published malicious `axios@1.14.1` and `axios@0.30.4`, bypassing the project’s normal GitHub Actions OIDC publishing flow and adding the staged dependency `plain-crypto-js@4.2.1`. That package’s `postinstall` logic fetched platform-specific payloads from `sfrclak[.]com:8000`, deploying a remote access trojan on Windows, macOS, and Linux while deleting installer artifacts and restoring benign-looking package metadata to hinder detection. The poisoned releases were available for roughly three hours before removal, but Axios’s massive downstream use meant developer workstations, CI/CD pipelines, ephemeral builds, and transitive dependencies could all have resolved the malicious versions during the exposure window. Researchers and vendors including Socket, StepSecurity, Elastic, Huntress, Microsoft, Google Threat Intelligence Group, and others said affected systems should be treated as fully compromised because the malware enabled reconnaissance, command execution, persistence on Windows, payload retrieval, and likely credential theft. Multiple reports tied the operation to a North Korea-linked actor—most prominently `UNC1069`, with other vendors using names such as Sapphire Sleet and STARDUST CHOLLIMA—while Axios later confirmed the maintainer had been compromised through a targeted social-engineering campaign involving fake corporate outreach and a bogus meeting workflow. Organizations were urged to roll back to safe versions such as `1.14.0` or `0.30.3`, remove `plain-crypto-js`, rebuild impacted hosts, rotate all accessible secrets, review lockfiles and CI logs, and block traffic to the identified command-and-control infrastructure.
Jul 23, 2026
A supply-chain compromise of **3CXDesktopApp** distributed digitally signed, trojanized installers to customers and triggered widespread detections in March 2023. Researchers said the operation, tracked as **SmoothOperator**, likely involved attacker infrastructure prepared as early as February 2022, while later reporting tied the campaign to the North Korea-linked **Lazarus Group** with medium to high confidence based on overlaps with **AppleJeus** infrastructure and malware traits. Investigators found the 3CX intrusion was itself enabled by an earlier software supply-chain breach, extending the attack chain beyond a single vendor compromise. Although the malicious 3CX software reached organizations globally, a more selective second stage delivered the **Gopuram** backdoor to fewer than ten machines, with cryptocurrency companies identified among the high-value targets.
Jun 29, 2026
North Korean state-sponsored threat actors have significantly escalated their 'Contagious Interview' campaign by flooding the npm registry with over 338 malicious packages designed to steal cryptocurrency and sensitive credentials. The operation leverages a repeatable playbook, with threat actors creating more than 180 fake personas and using new npm aliases and registration emails to distribute the malware. These malicious packages have collectively been downloaded over 50,000 times, indicating a substantial reach and potential impact on the developer community. The attackers primarily target Web3, cryptocurrency, and blockchain developers, as well as technical job seekers, often approaching them on LinkedIn under the guise of recruiters or hiring managers. The campaign follows a multi-stage attack chain, beginning with reconnaissance on social media, followed by weaponization through the publication of typosquatted npm packages. Delivery occurs via recruiter lures, leading to exploitation through malware loaders that execute in memory. The malware tooling has evolved, with initial stages using direct BeaverTail droppers, and more recent waves employing HexEval, XORIndex, and encrypted loaders that reconstruct BeaverTail in memory. Once executed, these loaders typically fetch the InvisibleFerret backdoor, which establishes persistence and enables further malicious actions. The attackers use over a dozen command and control endpoints to manage the compromised systems. The campaign is iterative, with new malicious packages appearing weekly and loader code being regularly tweaked to evade detection. The npm security team has been notified, and takedown requests have been submitted, but as of the latest reports, 25 malicious packages remain live on the registry. The operation has resulted in multi-stage compromises, including the theft of wallet keys and sensitive credentials, leading to financial losses for victims. The attackers' use of social engineering, technical obfuscation, and rapid distribution across new aliases demonstrates a high level of sophistication and adaptability. The campaign has been mapped to the Lockheed Martin Cyber Kill Chain, illustrating its comprehensive approach from reconnaissance to actions on objectives. Security researchers emphasize the need for heightened vigilance among developers, especially those in the cryptocurrency and blockchain sectors, and recommend immediate review of npm dependencies and enhanced monitoring for suspicious package activity. The ongoing nature of the campaign and the attackers' ability to quickly adapt their tactics pose a persistent threat to the software supply chain. Organizations are urged to implement robust security controls, educate staff about social engineering risks, and coordinate with npm and security vendors to mitigate exposure. The incident highlights the growing risk of supply chain attacks via open-source ecosystems and the need for industry-wide collaboration to address such threats.
Jun 29, 2026