← Back to feed
2026-04-23 Supply ChainMalware TLP:CLEAR

Axios npm Supply Chain Attack: Cross-Platform RAT Delivery via North Korea-Nexus Actor UNC1069

Date: 2026-04-23
Tags: supply-chain, malware

Executive Summary

On March 30, 2026, Elastic Security Labs detected a supply chain compromise targeting the axios npm package through automated supply-chain monitoring. The attacker gained control of the npm account belonging to jasonsaayman, one of the project's primary maintainers, and published two backdoored versions within a 39-minute window. The axios package is one of the most widely depended-upon HTTP client libraries in the JavaScript ecosystem. At the time of discovery, both the latest and legacy dist-tags pointed to compromised versions, ensuring that the majority of fresh installations pulled a backdoored release.

Campaign Summary

FieldDetail
Campaign / MalwareAxios npm Supply Chain Compromise (MAL-2026-2307)
AttributionUNC1069, a North Korea-nexus, financially motivated threat actor; also tracked as Sapphire Sleet, a North Korean state actor (confidence: high)
TargetAll organizations installing axios versions 1.14.1 or 0.30.4 across Windows, macOS, and Linux; one of the most widely depended-upon HTTP client libraries in the JavaScript ecosystem
VectorCompromised npm maintainer account used to directly publish malicious versions; plain-crypto-js postinstall hook silently downloaded and executed platform-specific stage-2 RAT implants
Statusactive
First Observed2026-03-30

Detailed Findings

On April 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on the compromise of the axios package in the npm ecosystem. This incident is being tracked as MAL-2026-2307 and highlights a growing class of npm supply chain attacks that propagate through automated CI/CD systems. The attacker compromised a maintainer account and published backdoored versions that delivered a cross-platform Remote Access Trojan to macOS, Windows, and Linux systems through a malicious postinstall hook. The attacker deployed three parallel implementations of the same RAT — one each for Windows, macOS, and Linux — all sharing an identical C2 protocol, command structure, and beacon behavior. This isn't three different tools; it's a single cross-platform implant framework with platform-native implementations. Axios lead maintainer Jason Saayman published a post-mortem explaining that the npm supply chain attack began with a targeted social engineering operation. In a follow-up explanation, he said the attackers built a highly convincing setup that closely resembled the tactics Google recently described in its report on UNC1069 social engineering activity. Both the latest and legacy dist-tags pointed to compromised versions, ensuring that the majority of fresh installations pulled a backdoored release.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195.001Direct compromise of npm package maintainer credentials to publish malicious versions to official registry
Social EngineeringT1598Targeted social engineering of package maintainer to capture credentials
Execution: Command and Scripting InterpreterT1059Postinstall script execution during package installation
Remote Access TrojanT1219Delivery and execution of cross-platform RAT implant

IOCs

Domains

sfrclak[.]com

Full URL Paths

sfrclak[.]com:8000

Splunk Format

"sfrclak[.]com" OR "sfrclak[.]com:8000"

Package Indicators

[email protected]
[email protected]
[email protected]

Detection Recommendations

Legitimate Axios releases always include OIDC provenance metadata and SLSA build attestations linking the npm package back to a specific GitHub Actions run. The malicious versions had none of this – they were published directly, leaving no verifiable build trail. For security teams: Require npm publish provenance checks (–provenance flag) and SLSA level 2+ for all internal and critical third-party packages. Absence of OIDC provenance on a new version of a major package should trigger an automatic alert. Monitor for npm package installations of versions 1.14.1 or 0.30.4; audit npm install/ci output logs for presence of plain-crypto-js dependency; check for outbound connections to sfrclak[.]com or 142.11.206[.]72 on port 8000; scan node_modules directories for plain-crypto-js or affected axios versions; implement package manager cache cleanup and dependency version pinning policies.

References