UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack

North Korean threat actors (UNC1069) compromised the Axios npm package via a targeted social engineering attack against its maintainer, Jason Saayman.

• •Attackers impersonated a legitimate company founder, invited Saayman to a branded Slack workspace with convincing channels sharing LinkedIn posts
• •During a fake Microsoft Teams call, a fake error prompt tricked him into triggering a remote access trojan installation
• •The trojan was used to steal npm credentials, enabling publication of two trojanized Axios versions (1.14.1 and 0.30.4) containing an implant called WAVESHAPER.V2
• •The attack overlaps with tradecraft from UNC1069/BlueNoroff, previously tracked as GhostCall by Kaspersky
• •Axios has ~100 million weekly downloads; the blast radius of such a supply chain attack propagates through direct and transitive dependencies at massive scale