CampaignPublished 1 Apr 2026

North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack

Source AlienVault OTX General

Description

Google Threat Intelligence Group (GTIG) is tracking an active software supply chain attack targeting the popular Node Package Manager (NPM) package "axios." Between March 31, 2026, 00:21 and 03:20 UTC, an attacker introduced a malicious dependency named "plain-crypto-js" into axios NPM releases versions 1.14.1 and 0.30.4. Axios is the most popular JavaScript library used to simplify HTTP requests, and these packages typically have over 100 million and 83 million weekly downloads, respectively. This malicious dependency is an obfuscated dropper that deploys the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.

Impact

The impact of this supply chain attack is substantial due to Axios’s ubiquity in web and software development worldwide. Organizations relying on the compromised Axios versions risk widespread infection by the WAVESHAPER.V2 backdoor, which can lead to unauthorized remote access, data theft, espionage, and disruption of services. The backdoor’s cross-platform capability increases the scope of affected environments, including critical infrastructure, enterprise applications, and cloud services. Confidentiality is at high risk as attackers can exfiltrate sensitive information. Integrity may be compromised through unauthorized code execution and manipulation of data or systems. Availability could be affected if attackers deploy destructive payloads or disrupt operations. The stealthy nature of the obfuscated dropper complicates detection and remediation, potentially allowing prolonged attacker presence. This attack also undermines trust in open-source software supply chains, potentially causing operational and reputational damage. The medium severity rating reflects the high impact but limited exploitation window and absence of known widespread exploitation at this time.

Defensive guidance

1. Immediately audit all projects and dependencies to identify usage of Axios versions 1.14.1 and 0.30.4 and the presence of the "plain-crypto-js" dependency. 2. Revert to Axios versions prior to or after the compromised releases once verified clean versions are available. 3. Employ software composition analysis (SCA) tools to detect malicious or unexpected dependencies in the supply chain. 4. Implement runtime detection for indicators of compromise related to WAVESHAPER.V2, including unusual network connections, process behaviors, and persistence mechanisms. 5. Monitor for the provided file hashes and suspicious domains associated with the attack to identify potential infections. 6. Enforce strict code signing and integrity verification for third-party packages before deployment. 7. Isolate and contain affected systems promptly upon detection to prevent lateral movement. 8. Educate developers and DevOps teams on supply chain risks and encourage use of trusted package registries and dependency pinning. 9. Collaborate with threat intelligence providers to stay updated on emerging indicators and patches. 10. Consider implementing network segmentation and least privilege principles to limit attacker impact if compromise occurs.

Indicators of compromise

Domains 4

package.md
sfrclak.com
proton.me
packages.npm.org

Hashes 16

04e3073b3cd5c5bfcde6f575ecf6e8c1
089e2872016f75a5223b5e02c184dfec
7658962ae060a222c0058cd4e979bfa1
7a9ddef00f69477b96252ca234fcbeeb
13ab317c5dcab9af2d1bdb22118b9f09f8a4038e
978407431d75885228e0776913543992a9eb7cc4
a90c26e7cbb3440ac1cad75cf351cbedef7744a8
58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668
617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101
92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 2 Apr 2026, 12:14 UTC

MITRE ATT&CK techniques5 from threat tags

Technical details

Indicators of compromise

Domains 4

Hashes 16

Community reviews

Related threats