Quick Facts
- North Korean hackers compromised Axios, downloaded 100 million times weekly, in a sophisticated supply chain attack
- Malicious versions were live for 2-3 hours on March 31, 2026, automatically infecting development and production environments
- Google attributes the attack to UNC1069, a financially motivated threat group that deployed platform-specific malware within 15 seconds of installation
North Korean hackers infiltrated one of the internet’s most critical code libraries, compromising the Axios JavaScript package that receives 100 million weekly downloads. The attack exposed organizations worldwide to malware for approximately three hours on March 31, 2026.
Google formally attributed the supply chain compromise to UNC1069, a financially motivated North Korean threat group. “We have attributed the attack to a suspected North Korean threat actor we track as UNC1069,” said John Hultquist, chief analyst at Google Threat Intelligence Group. “North Korean hackers have deep experience with supply chain attacks, which they’ve historically used to steal cryptocurrency.”
The attackers gained control of the npm account belonging to axios maintainer jasonsaayman and published two backdoored versions within a 39-minute window. The malicious versions introduced a dependency called plain-crypto-js, which silently downloaded platform-specific malware within seconds of installation.
Elastic Security Labs first detected the attack on March 30, 2026, through automated supply-chain monitoring. The malicious versions were live from 00:21 UTC to approximately 03:15 UTC on March 31, affecting any system that installed Axios during that window.
“The entire process, from installation to full compromise, took approximately 15 seconds,” according to OpenSourceMalware researchers. “Within two seconds of npm install, the malware was already calling home to the attacker’s server before npm had even finished resolving dependencies.”
The attack’s sophistication sets it apart from typical supply chain compromises. “This was not opportunistic,” security researchers noted. “The malicious dependency was staged 18 hours in advance. Three separate payloads were pre-built for three operating systems. Both release branches were hit within 39 minutes.”
StepSecurity described this as “among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package.” The malware deployed separate second-stage payloads for macOS, Windows, and Linux before erasing itself and replacing its package.json with a clean decoy.
Huntress observed at least 135 endpoints across all operating systems contacting the attacker’s command-and-control infrastructure during the exposure window. Wiz researchers noted execution in 3% of affected environments, despite the brief exposure time.
Organizations that installed the malicious versions face significant security risks. Any workflow that pulled the compromised packages may have exposed cloud keys, repository deploy keys, npm tokens, and other secrets to attackers. Security experts recommend treating affected machines as fully compromised.
The incident may trigger regulatory notification obligations under GDPR, CCPA, or sector-specific regulations for organizations that experienced credential exposure. The scale of potential impact makes this comparable to major npm compromises like the 2021 ua-parser-js attack.
“Hundreds of thousands of stolen secrets could potentially be circulating as a result of these recent attacks,” researchers warned. This could enable additional supply chain attacks, SaaS environment compromises, ransomware events, and cryptocurrency theft.
The real maintainer later stated they had two-factor authentication enabled on their accounts and were working with support to understand how the compromise occurred.
This article was written by an AI agent. Spotted an error? Send a correction and we will fix it.