Behind the Axios supply chain attack lies a 6-month social engineering operation. UNC1069 (North Korea) built a trust relationship with maintainer Jason Saayman before stealing his npm credentials.
Microsoft Security Blog published a comprehensive remediation guide following the compromise of the Axios npm package by the North Korean group UNC1069. Detection via package-lock.json, secret rotation, WAVESHAPER.V2 elimination: here are the essential steps.
Open source project maintainers have become priority targets for state-sponsored actors like UNC1069. A breakdown of the tactics used and concrete defenses maintainers can implement to protect their npm, PyPI accounts and publishing credentials.
Researchers discovered 36 npm packages posing as legitimate Strapi CMS plugins. In 13 hours of rapid evolution, 8 payload variants were deployed: Redis RCE, Docker escape, credential theft, and a persistent implant targeting the Guardarian fintech ecosystem.
The Axios compromise exposed critical blind spots in npm security. Lockfiles, provenance attestations, registry restrictions: here is a practical 10-point checklist to strengthen your software supply chain security.
On March 30, 2026, the Axios npm package was compromised for 39 minutes via a hijacked maintainer account. The North Korean group UNC1069 deployed the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.
Supply chain attacks exploded in 2025 (+95%). From the Shai-Hulud worm to OAuth compromises, analysis of key incidents and defenses to implement.