axios compromise attacker
Named by 3 kept items in this workspace.
Search every workspace for axios compromise attacker. It matches the name as written, so it can find other things that share it.
The items that name it 3
different group linked to North Korea; hijacked a maintainer account, added a postinstall hook pulling in a typosquatted package
Attacker who posed as a company founder, lured a lead maintainer into a video call, and used a fake 'your system is out of date' prompt to install a remote access trojan (RAT), gaining control of the victim's machine and live npm session; changed the account email and published two malicious version
Referenced prior campaign covered by Aikido in March 2026, using nearly identical playbook (malicious dependency plain-crypto-js, postinstall hook, decoy clean version first, self-deleting dropper, Hostwinds VPS callback on port 8000)
All threat actors in this workspace.