Executive Summary
On March 31, 2026, the North Korean state actor Sapphire Sleet (also known as BlueNoroff or Alluring Pisces) executed a supply chain attack by poisoning the Axios npm package, a widely used HTTP client. The actor published malicious versions 1.14.1 and 0.30.4, which included a hidden dependency, 'plain-crypto-js@4.2.1', designed to execute a second-stage remote access trojan (RAT) automatically upon installation.
The attack utilized a single command-and-control (C2) endpoint that delivered OS-specific payloads for Windows, macOS, and Linux based on POST request metadata. This campaign follows Sapphire Sleet's historical pattern of targeting the financial, cryptocurrency, and blockchain sectors to generate revenue and steal intellectual property. Organizations using Axios are urged to immediately downgrade to safe versions (1.14.0 or 0.30.3) and rotate any secrets exposed on development or CI/CD systems.
The technical sophistication of this attack is noted by the use of manifest-only changes to avoid source code scrutiny and the implementation of defense evasion techniques such as self-deleting installers and masquerading as legitimate system processes (e.g., 'wt.exe' and 'com.apple.act.mond').