Sapphire Sleet Axios NPM Supply Chain Compromise Execution

Ilyess Sellami@ilyessellami

•updated Apr 3, 2026•14•0•1,006

Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.