North Korean Hackers Breach Axios Package, Target Windows, macOS, and Linux Systems

A North Korea–nexus threat actor has hijacked the popular Axios NPM package in a high‑impact software supply chain attack that can silently backdoor Windows, macOS, and Linux systems.

Between March 31, 2026, 00:21 and 03:20 UTC, attackers used a compromised maintainer account to push backdoored Axios releases 1.14.1 and 0.30.4 to NPM.

The attackers changed the maintainer’s email to an attacker‑controlled ProtonMail address and quietly added a new dependency named plain-crypto-js version 4.2.1.

Axios is one of the most widely used JavaScript HTTP clients, with affected versions seeing tens of millions of weekly downloads, which amplifies the blast radius of this compromise.

Google Threat Intelligence Group (GTIG) tracks the campaign as activity by UNC1069, a financially motivated threat cluster active since at least 2018.

The malicious plain-crypto-js package is not used anywhere in Axios’s source code; its only purpose is to execute a postinstall script (setup.js) as soon as npm install runs.

The malware to execute before any developer code, including inside CI/CD pipelines and production build jobs.

Malicious Dependency and Dropper

The core dropper, SILKBELL (setup.js), uses custom XOR and Base64 obfuscation to hide its command‑and‑control (C2) URL and OS‑specific commands.

At runtime, it dynamically loads the fs, os, and execSync modules to evade straightforward static analysis.

The script fingerprints the host operating system, downloads a matching secondary payload, then attempts to delete itself and restore the original package.json from a backup file (package.md) to erase forensic traces of the postinstall hook.

On Windows, the malware searches for powershell.exe, copies it to %PROGRAMDATA%\wt.exe, and then uses curl with a crafted POST body (packages.npm.org/product1) to download a PowerShell payload into %TEMP%.

It then launches the script via the copied executable with hidden window and execution policy bypass flags, achieving stealthy code execution.

On macOS, the dropper uses curl and bash to pull down a Mach‑O binary into /Library/Caches/com.apple.act.mond using POST data packages.npm.org/product0, then chmods it and launches it via zsh in the background.

On Linux, it downloads a Python backdoor to /tmp/ld.py using POST data packages.npm.org/product2 before proceeding with execution.

All three OS‑specific branches ultimately deploy WAVESHAPER.V2, a cross‑platform remote access trojan (RAT) written primarily in C++ and supplemented by PowerShell and Python variants.

The implant beacons to the attacker’s C2 server over port 8000 every 60 seconds, sending Base64‑encoded JSON with system and environment metadata and using a hard‑coded User‑Agent string mimicking an outdated Internet Explorer client.

Supported commands include:

• kill – terminates the malware process.
• rundir – recursively enumerates directories and returns detailed file metadata.
• runscript – decodes and executes AppleScript payloads.
• peinject – drops and executes arbitrary binaries with optional parameters.

On Windows, persistence is achieved by creating a hidden batch file in %PROGRAMDATA%\system.bat and adding a MicrosoftUpdate entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Across platforms, the RAT supports extensive reconnaissance, arbitrary command execution (including in‑memory PE injection), and deep file system enumeration, making it suitable for data theft and follow‑on intrusion operations.

Attribution to UNC1069 and Broader Risk

GTIG attributes the attack to UNC1069 based on the use of WAVESHAPER.V2, infrastructure overlaps, and C2 patterns tied to domains such as sfrclak[.]com resolving to 142.11.206.73.

WAVESHAPER.V2 is a direct evolution of earlier WAVESHAPER backdoors previously linked to this actor, but now using JSON‑based C2 traffic, expanded telemetry collection, and richer command support while preserving the same polling behavior and unusual User‑Agent.

This incident lands amid a wave of open‑source supply chain attacks, including recent UNC6780 activity abusing PyPI and GitHub Actions to deliver the SANDCLOCK credential stealer.

Defenders should immediately audit environments for installations of axios@1.14.1 and axios@0.30.4 during the March 31 exposure window and replace them with known‑good versions.

With Axios embedded as a dependency in many other packages, compromised builds risk downstream SaaS compromises, ransomware or extortion incidents, and cryptocurrency theft as secrets and tokens are exfiltrated.

Logs should be reviewed for outbound connections to sfrclak[.]com:8000 and the distinctive User‑Agent to identify potential beaconing hosts.

Security teams should also rotate secrets and tokens used in affected CI/CD pipelines, strengthen maintainer account protections with phishing‑resistant MFA, and implement supply chain defenses that monitor for unexpected dependencies and npm lifecycle scripts like postinstall.

Indicators of Compromise (IOCs)

Indicator	Type	Notes
142.11.206.73	C2	WAVESHAPER.V2.
sfrclak[.]com	C2	WAVESHAPER.V2.
http://sfrclak[.]com:8000	C2	WAVESHAPER.V2.
http://sfrclak[.]com:8000/6202033	C2	WAVESHAPER.V2.
23.254.167.216	C2	Suspected UNC1069 Infrastructure.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.