Axios NPM Package Breached in North Korean Supply Chain Attack
Source SecurityWeek
Description
The Axios NPM package was compromised through a supply chain attack attributed to North Korean threat actors. Attackers exploited a long-lived NPM access token to bypass GitHub Actions' OIDC-based CI/CD publishing workflow, enabling them to push backdoored versions of the package. This breach allows malicious code to be distributed to developers and applications relying on Axios, a widely used HTTP client library in JavaScript environments. Although no known exploits in the wild have been reported yet, the potential for widespread impact exists due to Axios's extensive use in web and mobile applications. The attack highlights vulnerabilities in CI/CD pipeline security and token management. Mitigation requires immediate revocation of compromised tokens, strengthening CI/CD authentication mechanisms, and vigilant monitoring of package integrity. Countries with significant software development sectors and heavy reliance on JavaScript ecosystems, including the United States, India, Germany, South Korea, Japan, and the United Kingdom, are most at risk. Given the ease of exploitation and potential for supply chain compromise, the severity is assessed as high despite the current low severity rating. Defenders must prioritize securing CI/CD workflows and verifying package authenticity to prevent similar attacks.