Executive Summary
On March 31, 2026, a suspected North Korean state actor (tracked as UNC1069, Sapphire Sleet, or BlueNoroff) compromised the credentials of a primary Axios maintainer. The attacker published backdoored versions 1.7.9 and 0.28.2 of the ubiquitous HTTP client, incorporating a malicious dependency named 'plain-crypto-js'. This supply chain compromise facilitated the delivery of WAVESHAPER.V2, a cross-platform remote access trojan (RAT) affecting Windows, macOS, and Linux systems.
The attack bypassed modern OIDC Trusted Publishing controls by exploiting a legacy long-lived npm access token left in the environment. The malware was live for approximately three hours, resulting in an estimated 600,000 downloads. The primary objective appears to be credential harvesting from developer workstations and CI/CD runners to facilitate further financial theft or intellectual property espionage, consistent with documented North Korean tradecraft.
This incident underscores the critical risk to software supply chains and the necessity of monitoring developer environments. The speed of the compromise (first infection within 89 seconds of publication) highlights that manual response is insufficient against state-level adversaries operating at machine scale.