Axios oneof the most popular HTTP client for JavaScript, has been the victim of a supply chain by North Korean hackers using sophisticated social engineering. The attackers managed to compromise the main maintainer's account and publish two malicious versions to the npm registry, exposing millions of developers to risk. The incident highlights the growing threat facing the open-source from state-sponsored attackers targeting the software supply chain.
See also: UNC1069 attack on Axios npm package with social engineering
According to a detailed analysis published by Axios ’ maintainers , the attack began weeks earlier with a targeted social engineering attack against Jason Saayman , the project’s lead maintainer. The attackers impersonated a legitimate company, copied its identity and images of its founders, and invited the maintainer to a Slack workspace designed to mimic the company. This approach demonstrates the level of preparation and professionalism that characterizes modern Advanced Persistent Threat (APT) attacks .
Saayman describes the Slack space as being extremely convincing, with realistic channels, staged activity , and fake profiles posing as employees and other maintainers of open-source projects. “ They had channels where they were sharing LinkedIn posts. The LinkedIn posts I guess were just leading to the real company account, but it was extremely convincing ,” Saayman explained . Using authentic content from real companies is a classic tactic for attackers to create a sense of legitimacy and gain the trust of their victims.
The critical phase of the attack came when the attackers scheduled a meeting on Microsoft Teams that appeared to include multiple people. During the call, a technical error appeared claiming that something in the system was out of date, prompting the maintainer to install a Teams to fix the error. However, this fake update was actually RAT malware that gave the attackers remote access to the maintainer’s device. This technique, known as the ClickFix attack, exploits users’ tendency to follow troubleshooting instructions when they encounter technical issues.
Technical details of the Axios attack and malicious payload
After gaining access to Saayman 's device , the attackers were able to obtain the npm credentials for the Axios project . Using these credentials, they released two malicious versions : 1.14.1 and 0.30.4 . These versions introduced a dependency named plain-crypto-js that installed a remote access trojan (RAT) on macOS , Windows , and Linux systems . The malware was executed automatically via postinstall hooks , requiring no action from the developer, and had the ability to steal environment variables, AWS keys , GitHub tokens , and other sensitive credentials.
See also: Google attributes Axios Supply Chain Attack to UNC1069
The malicious versions were available for about three hours before being removed, but systems that installed them during that time should be considered compromised. The Google Threat Intelligence Group later linked this attack to North Korean attackers tracked as UNC1069, a financially motivated threat group that has been active since at least 2018.The group is known for its targeted attacks against cryptocurrency companies and open-source project maintainers.
The GTIG explained that it “attributes this activity to UNC1069, a financially motivated attacker with connections to North Korea, based on the use of WAVESHAPER.V2, an updated version of WAVESHAPER previously used by this attacker.” Furthermore, analysis of the infrastructure elements used in this attack shows overlaps with infrastructure used by UNC1069 in past activities. The malware also had the ability to erase its tracks, replacing files such as setup.js and package.json with innocent copies to avoid detection.
This attack is similar to a ClickFix attack , in which victims see a fake error message and are then prompted to follow troubleshooting steps that deploy malware . It also mirrors previous campaigns reported by Google ’s threat intelligence teams , in which North Korean attackers UNC1069 used the same tactics to target cryptocurrency companies. Other maintainers have reported similar social engineering attacks , where attackers tried to get them to install a fake Microsoft Teams SDK update .
Protection measures and recommendations for developers
To address such threats, cybersecurity experts recommend taking specific protective measures. First, developers should pin their dependency versions instead of using semver ranges (e.g. ^1.14.0), use lockfiles for deterministic installations, and implement multi-signature publishes for critical projects. Additionally, using OIDC tokens with a limited lifespan instead of permanent API keys can significantly reduce the risk of a breach.
See also: Axios Supply Chain Attack: Malicious versions distribute RAT
Axios maintainers said they have wiped the affected systems, reset all credentials, and are implementing changes to prevent similar incidents. The incident highlights the need for enhanced security measures in the npm ecosystem and the importance of educating open-source maintainers about social engineering techniques .
Source: bleepingcomputer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
