Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069

Google has attributed the supply chain attack on the Axios npm package to North Korean threat group UNC1069, which has been operational since 2018.

• •Attackers seized control of the Axios maintainer's npm account and pushed two trojanized versions (1.14.1 and 0.30.4) containing a malicious dependency called "plain-crypto-js"
• •The malicious package used a postinstall hook in package.json to silently execute a JavaScript dropper (SILKBELL) that delivers OS-specific payloads for Windows, macOS, and Linux
• •The backdoor WAVESHAPER.V2 supports four commands: kill, rundir, runscript, and peinject, and beacons to a C2 server every 60 seconds
• •WAVESHAPER.V2 is an evolution of a prior UNC1069 backdoor, now using JSON-based C2 communication and collecting more system information
• •