On March 31, North Korean threat actors compromised Axios, the most widely used HTTP client in the JavaScript ecosystem. 100 million weekly downloads. Present in roughly 80% of cloud environments. Used by individual developers, Fortune 500 companies, and government agencies alike.
The attack didn't involve zero-day exploits or sophisticated code injection. It started with a fake Slack workspace, a spoofed Teams call, and a maintainer who trusted what looked like a legitimate business meeting.
How It Happened
According to a post-mortem published by maintainer Jason Saayman, the attackers approached him impersonating the founder of a well-known company. They had cloned the founder's identity and built a fully branded Slack workspace with realistic channels, LinkedIn post sharing, and convincing company branding. Saayman described the operation as "extremely well coordinated, looked legit, and was done in a professional manner."
After building rapport through Slack, the attackers scheduled a Microsoft Teams call. During the call, Saayman was told a component on his system was out of date and was prompted to install an update. He did. The update was a remote access trojan.
With access to Saayman's machine, the attackers harvested his npm credentials and published two backdoored versions of Axios within a 39-minute window: version 1.14.1 (tagged latest) at 00:21 UTC and version 0.30.4 (tagged legacy) at 01:00 UTC. Both versions injected a new dependency called plain-crypto-js, a purpose-built malicious package with a postinstall hook that silently downloaded platform-specific RAT implants.
The compromised versions were live for roughly three hours before npm removed them.
What the Malware Did
The postinstall hook in plain-crypto-js downloaded executables from the command-and-control domain sfrclak[.]com on port 8000. The payloads were tailored for each operating system, according to Elastic Security Labs:
macOS received a compiled C++ binary disguised as an Apple system cache file, dropped to /Library/Caches/com.apple.act.mond. Windows got a PowerShell script executed through a renamed copy of PowerShell (wt.exe) placed in %PROGRAMDATA%, with persistence via a registry run key named "MicrosoftUpdate." Linux received a Python-based RAT written to /tmp/ld.py and launched through nohup.
All three variants belong to a malware family that Google Cloud Threat Intelligence (Mandiant) calls WAVESHAPER.V2. The backdoor beacons to its C2 server every 60 seconds using Base64-encoded JSON and a User-Agent string spoofing Internet Explorer 8 on Windows XP. It supports four commands: kill (self-terminate), rundir (enumerate directories), runscript (execute shell commands or AppleScript), and peinject (decode and execute arbitrary binaries in memory).
In-memory PE injection means the attackers could load and run any program on a compromised machine without writing it to disk. That's not a credential stealer. That's full remote control.
Who Did It
Google attributed the attack to UNC1069, a financially motivated North Korean threat cluster active since at least 2018. The attribution rests on multiple indicators: WAVESHAPER.V2 is an updated version of malware previously tracked to UNC1069, the C2 infrastructure connects to an AstrillVPN node the group has used before, and the macOS binary contained developer build paths referencing BlueNoroff's "webT" module from the RustBucket and Hidden Risk campaigns of 2023 and 2024.
Microsoft tracks the same group as Sapphire Sleet. CrowdStrike identifies them as Stardust Chollima with moderate confidence.
The Money Pipeline
UNC1069 is one node in a much larger machine. North Korea's cyber operations serve a single strategic purpose: funding its nuclear weapons and ballistic missile programs. The Reconnaissance General Bureau (RGB) runs the whole apparatus. Lazarus Group, BlueNoroff, Sapphire Sleet, Stardust Chollima, whatever naming convention you prefer, they all report to the same command structure.
The numbers are staggering. A UN panel documented approximately $3 billion stolen in 58 suspected cyberattacks on cryptocurrency companies between 2017 and 2023. Then, in February 2025, the Lazarus Group pulled $1.5 billion from Bybit in a single heist, exceeding what they stole in all of 2024 combined. Total estimates now exceed $6 billion over the past decade.
The Axios compromise fits this pipeline. Social engineering an npm maintainer is cheaper and quieter than breaching a crypto exchange directly. Once the RAT is running on developer machines inside financial institutions, defense contractors, or cloud providers, the access can be resold, weaponized for crypto theft, or used for espionage. Same playbook, different entry point.
Four Attacks in Two Weeks
This is the fourth major supply chain compromise targeting open-source infrastructure in the past two weeks, and Laterstack has covered all of them.
On March 19, the threat group TeamPCP hijacked Aqua Security's Trivy vulnerability scanner, rewriting 75 out of 76 version tags to inject credential-stealing malware into CI/CD pipelines worldwide. That attack cascaded downstream through LiteLLM and eventually contributed to a 4TB data breach at AI training vendor Mercor.
On March 25, TeamPCP extended its campaign to Checkmarx's GitHub Actions, compromising KICS and spreading a self-propagating worm across dozens of npm packages.
On March 28, Anthropic's own Claude Code source leaked through npm when unminified internal source was published to the registry without obfuscation. Different kind of failure, same infrastructure.
Now, on March 31, a separate North Korean group used social engineering rather than technical exploitation to achieve a similar result through a different vector entirely.
The pattern is consistent. Attackers are not breaking into systems. They are being let in through trust relationships: trusted maintainers, trusted scanners, trusted dependencies. The infrastructure that modern software depends on is defended by the same human vulnerabilities that every other system is.
What This Means for Everyday People
You probably have never typed npm install axios yourself. But software you use daily almost certainly depends on it. Axios handles HTTP requests for web applications, mobile apps, internal business tools, banking interfaces, healthcare portals. When a library this foundational gets compromised, the blast radius extends far beyond developers.
If you installed or updated any JavaScript project between 00:21 and 03:20 UTC on March 31, your system may have pulled in the compromised version automatically. The malware ran through a postinstall hook, meaning it executed without any user interaction, no prompts, no warnings.
If you're a developer: Check your package-lock.json for axios@1.14.1 or axios@0.30.4. Search your node_modules for plain-crypto-js. If you find either, treat the system as compromised, rotate all credentials, and block sfrclak[.]com and 142.11.206[.]73 at the network level. Saayman's post-mortem outlines the project's remediation steps, including adopting OIDC-based publishing and immutable releases.
If you're everyone else: The takeaway is structural. The open-source libraries that power the internet are maintained by small numbers of people, sometimes one person, who are reachable through normal channels. A convincing Slack message and a fake Teams call were enough to compromise a package that runs in 80% of cloud environments. No amount of code scanning catches a social engineering attack on a maintainer's personal machine.
npm did not have protections in place to prevent a compromised account from publishing a new major version at midnight UTC. That's a policy question, not a technology question. And it's a question that keeps going unanswered while the attacks keep coming.
For inquiries and analysis contact laterstack@proton.me