Behind the Axios supply chain attack lies a 6-month social engineering operation. UNC1069 (North Korea) built a trust relationship with maintainer Jason Saayman before stealing his npm credentials.
Microsoft Security Blog published a comprehensive remediation guide following the compromise of the Axios npm package by the North Korean group UNC1069. Detection via package-lock.json, secret rotation, WAVESHAPER.V2 elimination: here are the essential steps.
On March 30, 2026, the Axios npm package was compromised for 39 minutes via a hijacked maintainer account. The North Korean group UNC1069 deployed the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.