NPM-AXIOS-2026

How it happened

The compromised package was the real axios, maintained by Jason Saayman (npm account jasonsaayman), not a typosquat or an axios-* lookalike. The GitHub source was never touched; only the npm publish path was abused. By the maintainer's own post-mortem, the root cause was a targeted social-engineering campaign that planted a remote access trojan on his personal machine, which gave the attacker control of his npm account. The account email was changed to an attacker address (ifstap@proton.me), and a long-lived classic npm token was used to publish directly, sidestepping the project's OIDC trusted-publishing workflow entirely.

Two malicious versions went out: axios@1.14.1 on the current line and axios@0.30.4 on the legacy line, between roughly 00:21 and 03:20 UTC, live for about three hours before npm pulled them. Both added a phantom dependency, plain-crypto-js (versions 4.2.1 and 4.2.0), that axios never imports. A postinstall hook ran an obfuscated dropper nicknamed SILKBELL, which installed a backdoor called WAVESHAPER.V2: a cross-platform remote access trojan with a Windows variant (a staged PowerShell payload with registry run-key persistence), a macOS native binary at com.apple.act.mond, and a Linux Python loader at /tmp/ld.py. It beaconed every 60 seconds to a command-and-control server at sfrclak[.]com (142.11.206.73). Because the malice lived only in the published tarballs, anyone who ran npm install with install scripts enabled during that window, directly or transitively, executed the dropper.

The damage

The exposure was set by axios's reach, not by the short window. The 1.14.x line alone draws around 100 million weekly downloads and the 0.30.x line about 83 million, and axios is overwhelmingly a transitive dependency, present in an estimated 80 percent of cloud and code environments. Organisations were exposed even if no developer ever typed npm install axios. Detection was fast, which is the only reason this was not far worse: Socket flagged the package automatically within minutes, the first infection landed roughly 89 seconds after publish, and runtime monitors observed anomalous command-and-control traffic across thousands of projects before the versions were revoked. Every machine that pulled a poisoned version during the window has to be treated as compromised, with all reachable secrets and CI credentials rotated.

Who was behind it

Google Threat Intelligence attributes the attack to UNC1069, a financially motivated North Korea-nexus actor active since at least 2018, based on the WAVESHAPER malware lineage, shared command-and-control behaviour and an unusual user-agent string, a connection from an AstrillVPN node previously tied to the group, and adjacent infrastructure on the same network. Microsoft tracks the same activity as Sapphire Sleet. These are not competing claims: Microsoft states explicitly that Sapphire Sleet overlaps with UNC1069 and with the cluster also known as BlueNoroff, STARDUST CHOLLIMA, Alluring Pisces, CageyChameleon and CryptoCore. It is one DPRK group under several vendor names. This is the same ecosystem of operators that runs developer-targeted lures like the Contagious Interview npm campaign, now reaching for a top-tier dependency instead of bespoke bait.

Why it still matters

Two lessons set this apart from an ordinary maintainer takeover. First, a nation-state went after a near-universal transitive dependency to deliver an espionage and access trojan, not the usual crypto-stealer. The target tier is the escalation: poison axios for three hours and you reach a meaningful slice of the world's build pipelines. Second, the soft target was the human, not the registry. npm's publishing hardening (two-factor auth, OIDC trusted publishing) did nothing here, because the attacker owned the maintainer's laptop and a legacy long-lived token still worked. The durable defences are mechanical: disable install scripts by default so a postinstall payload cannot fire, kill long-lived classic tokens, and pin dependencies so a freshly poisoned version cannot flow straight into a build. Unlike the self-propagating Shai-Hulud worm, this attack was one-shot, but its blast radius shows that one-shot at the top of the dependency graph is its own category of risk.