North Korea's UNC1069 Backdoored Axios npm Package — 183 Million Weekly Downloads Exposed to WAVESHAPER.V2 Backdoor

The attack unfolded in carefully staged steps that demonstrate the sophisticated information security threat posed by North Korean supply chain operations. On March 30, 2026, the attacker first published a clean-looking package called plain-crypto-js@4.2.0 to npm — a trojanised copy of the legitimate crypto-js JavaScript library designed to appear legitimate to automated scanning tools. The following day at 23:59 UTC, they published plain-crypto-js@4.2.1 — the same package but now containing a postinstall hook that executes automatically on every npm install without any user interaction. Then in the early hours of March 31, the attacker used a compromised long-lived access token from the Axios maintainer account to publish two backdoored Axios versions — 1.14.1 at 00:21 UTC and 0.30.4 at 01:00 UTC — each injecting plain-crypto-js as a new runtime dependency. The digital security deception was precise: there are zero lines of malicious code inside the Axios package itself. The malicious code lives entirely in the injected dependency, making detection by npm audit and standard security scanners extremely difficult. When a developer ran npm install axios during the three-hour window, npm automatically executed the postinstall hook in plain-crypto-js, which triggered the SILKBELL dropper — an obfuscated JavaScript file called setup.js — which then detected the victim's operating system and fetched the appropriate WAVESHAPER.V2 backdoor variant from the C2 server at sfrclak[.]com.

The internet security and data security implications of this attack are severe and the full scope is still being determined. During the three-hour compromise window, approximately 3% of the Axios userbase installed the malicious versions — a number that sounds small but translates to millions of installation events given Axios's scale. The attack affects not just developers who directly depend on Axios but every project that uses Axios as a transitive dependency — which Wiz estimates includes approximately 80% of all cloud and code environments. This means the malicious package could have been installed in CI/CD pipelines, Docker builds, cloud environments, and automated dependency update systems without any human developer explicitly choosing to install it. UNC1069's primary objective based on GTIG analysis is cryptocurrency theft — the group has historically targeted crypto exchanges, DeFi platforms, and software developers with access to cryptocurrency-related infrastructure. Mandiant CTO Charles Carmakal warned that the hundreds of thousands of stolen secrets potentially circulating from this and related recent supply chain attacks "will enable more software supply chain attacks, SaaS environment compromises, ransomware and extortion events, and crypto heists over the next several days, weeks, and months." This attack also coincides with a separate supply chain campaign by UNC6780 — also known as TeamPCP — which poisoned GitHub Actions and PyPI packages from projects including Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer.