Supply Chain Compromise of axios npm Package

What it is

An active supply-chain compromise of the axios npm package (>100M weekly downloads), executed March 31, 2026. An attacker took over the lead maintainer account (jasonsaayman) and published two backdoored releases: [email protected] (tagged latest) and [email protected] (tagged legacy). Both delivered a cross-platform RAT to macOS, Windows, and Linux. Multiple vendors (Elastic, Google Threat Intelligence Group, Volexity) attribute the campaign to North Korean state activity — GTIG names UNC1069, and internal artifacts (macWebT) link to BlueNoroff's webT module from RustBucket.

How it works

The backdoored axios versions declared a phantom dependency — [email protected], a package created that same day and never actually imported by axios. Its only role: a postinstall script that drops and runs the RAT automatically on npm install, no user interaction. Account access came via a long-lived npm access token, not the OIDC Trusted Publishing workflow. Critically, even on the v1.x branch where OIDC was configured, the publish workflow still passed NPM_TOKEN alongside OIDC credentials — and when both are present, npm uses the token, making the long-lived token the effective auth for all publishes. The maintainer email was changed to ifstap@proton[.]me.

flowchart TD
  A[Pre-stage: nrwise@proton account<br/>publishes clean plain-crypto-js 1.0.0] --> B[~18h later: token-based publish<br/>of backdoored axios]
  B --> C{npm resolves version}
  C -->|1.12.0 latest / 0.31.0 legacy| D[phantom dep plain-crypto-js<br/>postinstall drops RAT]
  C -->|pinned safe version| E[unaffected]
  D --> F[C2 contact — first hit 89s after publish]

Preconditions / Affected

Any environment that ran npm install and resolved to [email protected] or [email protected] during the ~3-hour exposure window (published just after midnight UTC Sun→Mon; removed ~3h later). Applies to macOS, Windows, and Linux. Huntress observed ≥135 endpoints across all OSes contacting C2. The attack was pre-staged ~18h ahead: plain-crypto-js was first published clean by an attacker account (nrwise@proton[.]me) to build publishing history and dodge novelty-based scanners.

What to do

• Audit dependencies for [email protected] and [email protected].
• Treat any system that installed either version as fully compromised — rotate all credentials and rebuild affected systems. The RAT's credential-theft and exfiltration capabilities mean the full scope may not be immediately apparent.
• IOCs: attacker maintainer email ifstap@proton[.]me; pre-staging account nrwise@proton[.]me; C2 domains calltan[.]com and callnrwise[.]com (calltan linked by Volexity to a DPRK binary).

Caveats

The malicious packages are removed from npm and C2 is offline, so no new exploitation is expected from these addresses — but already-executed payloads remain a live compromise. The exact method of token compromise is undetermined; the maintainer states MFA was enabled on "practically everything." Attribution to DPRK is corroborated across several vendors but motive remains unclear. Article was written with AI assistance.