North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack

Google Threat Intelligence Group (GTIG) details an active supply chain attack on the axios NPM package attributed to North Korea-linked threat actor UNC1069.

• •Attacker compromised the axios maintainer account and introduced malicious dependency "plain-crypto-js" into versions 1.14.1 and 0.30.4 on March 31, 2026
• •The malicious package used a postinstall hook to silently execute an obfuscated dropper (setup.js / SILKBELL) that delivers OS-specific payloads for Windows, macOS, and Linux
• •Final payload is WAVESHAPER.V2, a C++ backdoor (with PowerShell and Python variants) that beacons to C2 every 60 seconds and supports commands: kill, rundir, runscript, and peinject
• •Attribution to UNC1069 is based on WAVESHAPER.V2 lineage, shared C2 infrastructure, and AstrillVPN node overlap with prior UNC1069 operations