Axios npm Supply Chain Attack: North Korean Sapphire Sleet Targets 70 Million Weekly Downloads

What Is Axios and Why Does This Attack Matter?

Axios is a popular JavaScript HTTP client library that simplifies making HTTP requests to REST APIs [1]. It's one of the most depended-upon packages in the JavaScript ecosystem, with approximately 70-100 million weekly downloads [2].​‌‌​​​​‌‍​‌‌‌‌​​​‍​‌‌​‌​​‌‍​‌‌​‌‌‌‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌​‌‌‌​‍​‌‌‌​​​​‍​‌‌​‌‌​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​​​‍​‌‌‌​​​​‍​‌‌​‌‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌​‌​​​‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​​‍​‌‌‌​‌​​‍​‌‌​​​​‌‍​‌‌​​​‌‌‍​‌‌​‌​‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​​​​‌‍​‌‌‌​​​​‍​‌‌‌​​​​‍​‌‌​‌​​​‍​‌‌​‌​​‌‍​‌‌‌​​‌​‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​​‍​‌‌​​‌​‌‍​‌‌​​‌​‌‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​‌‌​​‌‌‌‍​‌‌‌​‌​‌‍​‌‌​‌​​‌‍​‌‌​​‌​​‍​

‌‌​​‌​‌

Why this matters for your business:

• Your development team likely uses Axios or depends on applications that do
• Supply chain attacks bypass traditional security by compromising trusted dependencies
• North Korean state actors targeting software developers represents an escalation in cyber threats

This isn't just a technical vulnerability — it's a strategic attack on the software supply chain that your business depends on.​‌‌​​​​‌‍​‌‌‌‌​​​‍​‌‌​‌​​‌‍​‌‌​‌‌‌‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌​‌‌‌​‍​‌‌‌​​​​‍​‌‌​‌‌​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​​​‍​‌‌‌​​​​‍​‌‌​‌‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌​‌​​​‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​​‍​‌‌‌​‌​​‍​‌‌​​​​‌‍​‌‌​​​‌‌‍​‌‌​‌​‌‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​​​​‌‍​‌‌‌​​​​‍​‌‌‌​​​​‍​‌‌​‌​​​‍​‌‌​‌​​‌‍​‌‌‌​​‌​‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​​‍​‌‌​​‌​‌‍​‌‌​​‌​‌‍​‌‌‌​‌​​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​‌‌​​‌‌‌‍​‌‌‌​‌​‌‍​‌‌​‌​​‌‍​‌‌​​‌​​‍​‌‌​​‌​‌

The Attack: How Sapphire Sleet Compromised Axios

On March 31, 2026, two malicious versions of Axios were published to npm:

• [email protected] (tagged as "latest")
• [email protected] (tagged as "legacy")

A compromised maintainer account was used to publish these versions, shifting from the trusted GitHub Actions OIDC publishing flow to direct CLI publishing from a different email address [3].

The attacker's technique:

1. Compromised the npm maintainer account (jasonsaayman)
2. Changed the email from [email protected] to [email protected] [4]
3. Published two versions with a single malicious dependency: plain-crypto-js@^4.2.1
4. The malicious dependency delivered a cross-platform RAT during installation

Why this approach is dangerous:

• The malicious package appeared legitimate — it was published by a known maintainer
• Auto-update patterns (^ and ~ in package.json) caused automatic installation
• The attack affected both current and legacy versions simultaneously, maximizing blast radius [5]

plain-crypto-js: The Malicious Dependency

The attack didn't modify Axios code directly. Instead, it injected a fake dependency called plain-crypto-js that executed automatically during npm installation [6].

The infection chain:

1. Developer runs npm install axios or a project auto-updates
2. npm resolves dependencies and downloads [email protected]
3. The package's postinstall hook automatically runs node setup.js
4. setup.js decodes obfuscated strings and connects to a command-and-control (C2) server
5. Platform-specific second-stage RAT is downloaded and executed

This is silent execution — no user interaction required beyond the normal npm install process [7].

The Cross-Platform RAT: One Implant, Three Implementations

Microsoft and Elastic Security Labs analysis revealed that the second-stage payloads are not three different tools, but three implementations of the same RAT specification [8].

Shared across all platforms:

• C2 transport: HTTP POST
• Base64-encoded JSON communication
• Spoofed User-Agent: mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0) [9]
• 60-second beacon interval
• Identical command set: kill, runscript, peinject, rundir

Platform-specific delivery:

Platform	Delivery Method	RAT Implementation	Persistent Artifact
Windows	VBScript → PowerShell	6202033.ps1	%PROGRAMDATA%\wt.exe (masquerading as Windows Terminal)
macOS	AppleScript via osascript	Native C++ binary: com.apple.act.mond	/Library/Caches/com.apple.act.mond
Linux	Direct curl download	Python payload: ld.py	/tmp/ld.py

The IE8 User-Agent is a critical detection indicator: It's anachronistic on all modern systems and immediately suspicious on macOS and Linux hosts [10].

Sapphire Sleet: North Korean State Actors

Microsoft Threat Intelligence attributes this attack to Sapphire Sleet, a North Korean state-sponsored threat group active since at least March 2020 [11].

Sapphire Sleet profile:

• Primary focus: Finance sector, including cryptocurrency, venture capital, and blockchain organizations
• Motivation: Cryptocurrency wallet theft for revenue generation
• Targets: Global, with emphasis on the United States, Asia, and the Middle East
• Overlap: Also tracked as UNC1069, STARDUST CHOLLIMA, Alluring Pisces, BlueNoroff, CageyChameleon, or CryptoCore by other security vendors

Why npm? Supply chain attacks allow state actors to achieve broad downstream impact from a single compromise. Infecting Axios provides access to thousands of organizations globally — far more efficient than targeted attacks.

The Anti-Forensics: Cleaning Up After Compromise

The plain-crypto-js dropper includes anti-forensic measures designed to evade detection:

After payload delivery:

1. Self-deletion: fs.unlink(__filename) removes setup.js
2. Manifest swap: Renames package.md (clean manifest) to package.json, overwriting the malicious version [12]

The result: Post-incident inspection of node_modules/plain-crypto-js/package.json reveals no trace of the postinstall trigger. Only npm audit logs and lockfiles retain evidence.

This is sophisticated operational security designed to delay detection and incident response.

What Your Business Needs to Do Right Now

If You Use Axios or npm Dependencies

Immediate actions:

1. Check your versions:

   npm list axios

   If you see [email protected] or [email protected], you're affected.

2. Roll back to safe versions:

   npm install [email protected]
   # or for legacy
   npm install [email protected]

3. Clean your npm cache:

   npm cache clean --force

4. Rotate all secrets:

   • API keys
   • Database credentials
   • Cloud service tokens
   • SSH keys that may have been exposed to compromised systems

5. Check for the malicious dependency:

   grep -r "plain-crypto-js" node_modules/

6. Review CI/CD logs:

   • Look for npm install executions between March 30-31, 2026
   • Check for outbound connections to sfrclak[.]com or 142.11.206[.]73:8000
   • Audit developer machines for plain-crypto-js or affected Axios versions [13]

Hardening Your npm Supply Chain

Preventive measures for the future:

1. Disable auto-upgrades for critical packages: In package.json, use exact versions instead of caret (^) or tilde (~):

   "dependencies": {
     "axios": "1.14.0"  // not "axios": "^1.14.0"
   }

2. Adopt Trusted Publishing with OIDC:

   • Eliminates stored credentials
   • Uses GitHub Actions OIDC for provenance
   • Compromised npm accounts alone are insufficient to publish [14]

3. Disable postinstall scripts by default:

   npm config set ignore-scripts true

   Or use npm ci --ignore-scripts during CI/CD builds.

4. Implement dependency pinning:

   • Use npm overrides to force specific versions of transitive dependencies
   • Prevents surprise updates from compromised packages

5. Enable npm 2FA:

   • Require two-factor authentication for package publishing
   • Makes account compromise significantly harder

Detection: How to Know If You're Compromised

Network indicators:

• Outbound connections to sfrclak[.]com:8000
• Connections to IP 142.11.206.73 on port 8000
• HTTP POST traffic with User-Agent: mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0) [15]

File system indicators:

Windows:

• %TEMP%\6202033.ps1 (transient PowerShell RAT)
• %PROGRAMDATA%\wt.exe (masquerading PowerShell copy)
• %PROGRAMDATA%\system.bat (persistence mechanism)
• Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate

macOS:

• /Library/Caches/com.apple.act.mond (C++ binary RAT)
• SHA-256: 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a

Linux:

• /tmp/ld.py (Python RAT)
• SHA-256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf

Process indicators:

• Suspicious PowerShell executions with encoded commands
• osascript processes on macOS
• python3 executing scripts from /tmp

The Business Impact: Beyond Technical Compromise

This supply chain attack represents several business risks:

1. Credential exposure: The RAT can enumerate files, execute commands, and inject payloads. Any credentials accessible to compromised systems are exposed.

2. Intellectual property theft: Sapphire Sleet targets cryptocurrency and blockchain technology. If your business works in fintech or has proprietary algorithms, you're a priority target.

3. Supply chain trust erosion: Every dependency is now suspect. Rebuilding trust in your software stack takes time and resources.

4. Incident response costs: Forensic analysis, credential rotation, system rebuilds, and potential breach notifications add up quickly.

5. Regulatory and compliance exposure: If customer data was exposed on compromised systems, breach notification obligations may apply.

Why Supply Chain Attacks Are Increasing

The Axios compromise is part of a broader trend:

Recent supply chain attacks:

• SolarWinds (2020): Russian APT29 compromised Orion updates, affecting 18,000+ customers
• Codecov (2021): Credential theft exposed customer CI/CD environments
• Trivy npm (March 2026): Sapphire Sleet compromised another widely-used tool [16]
• ** MOVEit (2023):** Cl0p ransomware exploited a vulnerability in a file transfer tool, affecting nearly 100 million individuals

Why attackers love supply chains:

• Leverage: Compromise one package, infect thousands of organizations
• Trust: Malicious code arrives through trusted channels
• Access: Supply chain compromises bypass perimeter defenses
• Detection: Malicious activity blends with legitimate software operations

The Role of Software Bill of Materials (SBOM)

This attack demonstrates the importance of Software Bill of Materials (SBOM) for effective supply chain security.

An SBOM is:

• A formal inventory of software components and dependencies
• A machine-readable list of libraries, packages, and versions
• A tool for rapid vulnerability assessment during incidents

With an SBOM:

• When Axios 1.14.1 was reported compromised, you could immediately query: "Do we use this version?"
• Impact assessment takes minutes instead of days
• You can prioritize remediation based on actual usage, not theoretical exposure

Without an SBOM:

• Manual code reviews and dependency audits
• Delayed response while teams figure out exposure
• Wider blast radius due to uncertainty

Developer Security: What Your Team Needs to Know

For development teams:

1. Treat dependency updates as security events:

   • Don't blindly auto-update dependencies
   • Review changelogs for security-sensitive changes
   • Test updates in staging before production

2. Implement security review workflows:

   • Require approval for dependency version changes
   • Automate vulnerability scanning in CI/CD pipelines
   • Maintain separation between development and production credentials

3. Use package provenance tools:

   • Verify SLSA provenance attestations
   • Check for trusted publisher bindings
   • Flag packages published via direct CLI upload instead of CI/CD

4. Educate about social engineering:

   • Sapphire Sleet uses LinkedIn to initiate contact [17]
   • Be suspicious of unsolicited job offers or collaboration requests
   • Verify identities through multiple channels before sharing access

Legal and Regulatory Considerations

If your business was affected by this supply chain attack, consider:

Breach notification obligations:

• If customer data or credentials were exposed, notification timelines apply (e.g., 72 hours under GDPR, various state timelines in the US)
• Document your investigation and response for regulatory reporting

Contractual obligations:

• Review contracts with customers who may have been affected
• Check insurance policies for cyber coverage related to supply chain incidents

Liability exposure:

• If your compromised systems exposed customers to secondary attacks
• If intellectual property was stolen and used by competitors

Consult with legal counsel to understand your specific obligations.

FAQ

References

[1] Axios Documentation, "Axios HTTP Client," axios.com, 2026. [Online]. Available: https://axios-http.com/docs/intro

[2] Microsoft Security Blog, "Mitigating the Axios npm supply chain compromise," Microsoft, April 1, 2026. [Online]. Available: https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/

[3] Elastic Security Labs, "Inside the Axios supply chain compromise - one RAT to rule them all," Elastic, April 2, 2026. [Online]. Available: https://www.elastic.co/security-labs/axios-one-rat-to-rule-them-all

[4] Ibid.

[5] Microsoft Security Blog, "Mitigating the Axios npm supply chain compromise," Microsoft, April 1, 2026.

[6] Elastic Security Labs, "Inside the Axios supply chain compromise," Elastic, April 2, 2026.

[7] Microsoft Security Blog, "Mitigating the Axios npm supply chain compromise," Microsoft, April 1, 2026.

[8] Elastic Security Labs, "Inside the Axios supply chain compromise," Elastic, April 2, 2026.

[9] Microsoft Security Blog, "Mitigating the Axios npm supply chain compromise," Microsoft, April 1, 2026.

[10] Elastic Security Labs, "Inside the Axios supply chain compromise," Elastic, April 2, 2026.

[11] Microsoft Security Blog, "Mitigating the Axios npm supply chain compromise," Microsoft, April 1, 2026.

[12] Elastic Security Labs, "Inside the Axios supply chain compromise," Elastic, April 2, 2026.

[13] Microsoft Security Blog, "Mitigating the Axios npm supply chain compromise," Microsoft, April 1, 2026.

[14] Ibid.

[15] Elastic Security Labs, "Inside the Axios supply chain compromise," Elastic, April 2, 2026.

[16] Microsoft Security Blog, "Detecting, investigating, and defending against Trivy supply chain compromise," Microsoft, March 24, 2026. [Online]. Available: https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/

[17] Microsoft Security Blog, "Mitigating the Axios npm supply chain compromise," Microsoft, April 1, 2026.

[18] Fortune, "Mercor, a $10 billion AI startup, confirms it was the victim of a major cybersecurity breach," Fortune, April 2, 2026. [Online]. Available: https://fortune.com/2026/04/02/mercor-ai-startup-security-incident-10-billion/

---

Supply chain attacks like the Axios compromise bypass traditional defenses and strike at the heart of modern software development. At lil.business, we help small businesses secure their development pipelines, assess supply chain risk, and build resilient security practices. Book a consultation at https://consult.lil.business?utm_source=blog&utm_medium=post&utm_campaign=axios-supply-chain-2026

npm list axios

npm install [email protected]  # or [email protected] for legacy

npm cache clean --force

grep -r "plain-crypto-js" node_modules/

"axios": "^1.14.0"

"axios": "1.14.0"

npm config set ignore-scripts true

npm ci --ignore-scripts