CampaignPublished 3 Apr 2026

Securing the Supply Chain: How SentinelOne's AI EDR Stops the ...

Source AlienVault OTX General

Description

On March 31, 2026, a North Korean state actor hijacked the npm credentials of the primary Axios maintainer and published two backdoored releases that deployed a cross-platform remote access trojan (RAT) to Windows, macOS, and Linux systems. Axios is the most widely used HTTP client in the JavaScript ecosystem, with approximately 100 million weekly downloads and a presence in roughly 80% of cloud and code environments.

Impact

The compromise of Axios's npm credentials and subsequent publication of backdoored releases potentially exposes millions of systems to a remote access trojan. This could allow attackers to gain unauthorized access and control over affected systems across multiple operating systems. Given Axios's extensive usage, the impact is widespread across cloud and development environments. However, there is no evidence in the data of active exploitation beyond the initial incident, and no known exploits in the wild have been confirmed.

Defensive guidance

Users of Axios should verify the integrity of their dependencies and avoid using the compromised versions. Monitoring official Axios and npm advisories for updates and applying any official fixes promptly is recommended. Employing endpoint detection and response (EDR) solutions capable of detecting anomalous behavior related to this threat may help mitigate risk. Do not rely solely on generic security measures; focus on verifying package authenticity and updates from trusted sources.

Summary

A state-sponsored threat actor from North Korea hijacked the npm credentials of the primary Axios maintainer and released two malicious versions of the Axios package. These versions contained a backdoor that deployed a remote access trojan capable of running on Windows, macOS, and Linux platforms. Axios is a critical dependency in the JavaScript ecosystem, widely used across cloud and development environments. The attack represents a significant supply chain compromise, exploiting trust in a popular open-source library to distribute malware broadly. The technical details include hashes of malicious files and domains used for command and control.

Indicators of compromise

Domains 4

callnrwise.com
chickencoinwin.website
focusrecruitment.careers
sfrclak.com

URLs 1

http://sfrclak.com:8000/6202033

Hashes 7

21d2470cae072cf2d027d473d168158c
db7f4c82c732e8b107492cae419740ab
07d889e2dadce6f3910dcbc253317d28ca61c766
2553649f2322049666871cea80a5d0d6adc700ca
d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71
58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668
5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd

Community reviews

Loading reviews…