North Korea Hijacked the Axios npm Package. Your App Might Be

Green matrix-style digital code streaming down a dark screen — Photo via Unsplash

TL;DR: On March 31, 2026, North Korean hackers from the group UNC1069 hijacked Axios (one of the most popular JavaScript libraries on Earth, pulled 70 million times per week) and pushed two trojanized versions (1.14.1 and 0.30.4) loaded with a cross-platform backdoor called WAVESHAPER.V2. The malicious code was live for roughly three hours before npm yanked it. That was long enough. The attackers got in by deepfaking a video call with the package's maintainer, Jason Saayman, impersonating a real company founder with cloned voice and likeness. They built a fake Slack workspace, fake LinkedIn activity, and scheduled a Microsoft Teams meeting that deployed a RAT onto Saayman's machine. From there, they stole his npm credentials and published the poisoned versions. Google, Microsoft, and CrowdStrike all independently attributed the attack to North Korea. The same hacking apparatus pulled off the $285 million Drift Protocol theft the same day. This isn't just a supply chain attack. It's a state-sponsored surveillance and theft operation funded by stolen cryptocurrency.

39 Minutes That Compromised Millions of Machines

On March 30, 2026, Elastic Security Labs detected something wrong with Axios. Two new versions (1.14.1 and 0.30.4) had appeared with a dependency nobody had seen before: plain-crypto-js.^[1]

That dependency was the weapon. Its postinstall hook silently downloaded and executed platform-specific malware from sfrclak[.]com:8000 the moment anyone ran npm install. macOS users got a C++ binary. Windows users got a PowerShell payload. Linux users got Python. All three variants connected back to the same command-and-control server every 60 seconds.^[2]

The attacker had publishing access for 39 minutes. In that window, they pushed both versions and watched the downloads tick up. Axios gets over 70 million installs per week. It's embedded in healthcare platforms, banking apps, government systems, and an unknowable number of internal tools across every industry.^[3]

Within 17 minutes of the poisoned version going live, someone had already mirrored it as @depup/axios, expanding the blast radius beyond npm's ability to contain it by simply yanking the original.^[2]

npm pulled the malicious versions roughly three hours after publication. By then, the damage was done.

The Deepfake That Opened the Door

Jason Saayman, one of Axios's primary maintainers, didn't hand over his credentials willingly. He was conned by one of the most sophisticated social engineering operations ever documented against an open-source developer.

The attackers approached Saayman by impersonating the founder of a legitimate, well-known company. They cloned the founder's likeness and voice. They created a fake Slack workspace branded to match the company's CI/CD operations, complete with plausible channel activity, shared LinkedIn posts, team profiles, and what appeared to be other open-source maintainers.^[4]

Saayman described the setup: "They had channels where they were sharing LinkedIn posts." The workspace looked real. The people in it looked real. Everything was "thought out very well."^[4]

After building rapport, the attackers moved to a Microsoft Teams meeting with what appeared to be multiple participants. During the call, Saayman was shown a fraudulent error message claiming something on his system "was out of date." He triggered the "update." That update was a remote access trojan.^[4]

Saayman later called the entire operation "extremely well coordinated, looked legit, and was done in a professional manner."^[4]

With the RAT on his machine, the attackers grabbed his npm credentials. From there, it was a matter of minutes to push the trojanized packages.

Inside WAVESHAPER.V2: What the Backdoor Does

The payload that landed on infected machines wasn't some crude data stealer. It was WAVESHAPER.V2, an updated version of a backdoor North Korean hackers have been refining since at least 2023.^[2]

WAVESHAPER.V2 supports four commands:

kill: terminate execution and cover tracks
rundir: enumerate directories (map what's on the machine)
runscript: execute OS-specific scripts (run anything)
peinject: decode and execute binaries (deploy additional malware)

It beacons home every 60 seconds using JSON-based messaging with a distinctive User-Agent string. The C2 servers (sfrclak[.]com at IP 142.11.206.73) were traced to infrastructure previously used by UNC1069.^[2]

Security researchers at Elastic found a smoking gun inside the macOS binary: a developer build path reading Jain_DEV/client_mac/macWebT/macWebT. That "webT" module directly links to BlueNoroff's RustBucket and Hidden Risk malware campaigns from 2023-2024.^[1]

This wasn't a one-off tool. It was part of an evolving toolkit that North Korean hackers share across multiple operations.

Three Intelligence Firms, One Answer: North Korea

Google's Threat Intelligence Group formally attributed the attack to UNC1069, a financially motivated North Korean threat cluster active since at least 2018. Microsoft separately identified the same group under their tracking name Sapphire Sleet (also known as CryptoCore, CageyChameleon, or BlueNoroff). CrowdStrike linked it to Stardust Chollima with moderate confidence.^[2][5]

The attribution evidence was strong:

Connections from a specific AstrillVPN node previously used exclusively by UNC1069^[5]
Adjacent infrastructure on the same ASN historically linked to the group's operations^[5]
The WAVESHAPER.V2 implant matching code from prior North Korean campaigns^[1]
Build artifacts in the binary tying it to BlueNoroff's known development environment^[1]

Google's Threat Intelligence Group also documented the group's use of "AI-generated deepfakes and real-time audio impersonation during live video calls" and their deployment of generative AI tools (including Google Gemini) to produce lure materials.^[2]

Socket, the supply chain security firm, later revealed that multiple high-impact Node.js maintainers faced similar coordinated attacks around the same time, confirming this wasn't a one-off operation. It was a scalable campaign.^[4]

The Same Day: $285 Million Gone in 12 Minutes

March 31 wasn't just the day UNC1069 poisoned Axios. It was also the day North Korean hackers drained $285 million from Drift Protocol, a Solana-based decentralized finance platform: the largest DeFi hack of 2026.^[6]

The Drift attack was a different operation, but the playbook was identical. Attackers spent six months infiltrating Drift under the guise of a quantitative trading firm. They met Drift contributors at conferences. They deposited over $1 million in the protocol. They integrated an Ecosystem Vault. Then they used a compromised admin key and a fake token to manipulate oracles and drain $285 million in roughly 12 minutes.^[7]

TRM Labs attributed the Drift theft to the same North Korean hacking apparatus. DRIFT's token dropped 40%. Its total value locked fell from $550 million to under $300 million in an hour.^[6]

Two simultaneous attacks. Two different vectors. One target: fund the regime.

Stolen Code, Stolen Crypto, Surveillance State

This isn't just a cybersecurity story. It's a surveillance story.

North Korea's hacking operations have stolen over $6.5 billion in cryptocurrency in recent years, according to the U.S. Treasury Department and blockchain analytics firms. The money funds North Korea's weapons programs, and its surveillance apparatus.^[8]

North Korea operates one of the most extensive domestic surveillance states on the planet. Every citizen's phone runs state-mandated monitoring software. Internet access is restricted to an intranet controlled by the government. Defection attempts are tracked with biometric databases, informant networks, and increasingly, AI-powered monitoring systems.^[9]

The cryptocurrency stolen by groups like UNC1069 pays for all of it. The $285 million taken from Drift Protocol. The credentials harvested from the Axios supply chain attack. The previous $620 million Ronin Network hack. The $235 million WazirX theft. It all flows back to the same place.

When you hear "state-sponsored hacking," think of it this way: every npm install of the poisoned Axios version potentially funded surveillance cameras pointed at North Korean citizens trying to escape.

What to Do Right Now

If you or your organization uses Axios (and if you're a developer, you almost certainly do):

Check your version immediately. Versions 1.14.1 and 0.30.4 are compromised. Downgrade to 1.14.0 or 0.30.3. Pin the safe version in your package-lock.json.
Audit your node_modules. Search for plain-crypto-js. If it's there, your machine has been compromised.
Block the C2 domains. Add sfrclak[.]com and IP 142.11.206.73 to your firewall blocklist.
Rotate credentials. If you installed the compromised version, assume any credentials accessible on that machine have been stolen. API keys, SSH keys, npm tokens, database passwords: all of them.
Check for the process. Look for unusual processes beaconing outbound every 60 seconds. On macOS, search for binaries with the "macWebT" string.
Enable npm's provenance checking. npm now supports provenance attestation for packages. Configure your projects to require it where available.
Use lockfiles religiously. A package-lock.json or yarn.lock pinning to known-safe versions would have prevented this attack for anyone who didn't manually update.

This Was a Template, Not a One-Off

Security researchers are treating this attack as a blueprint. Google's Threat Intelligence Group warned that "hundreds of thousands of stolen secrets" from recent supply chain attacks could enable ransomware, extortion, and cryptocurrency theft by UNC1069's partner groups, including the Vect RaaS operation and Lapsus$ extortion groups.^[2]

The recipe is replicable: identify an overworked open-source maintainer (and they're almost all overworked). Build a convincing corporate persona with deepfake video and cloned voices. Create a fake Slack workspace that looks like a real company. Run the social engineering campaign for weeks or months. Get the credentials. Poison the package. Cash out.

Jason Saayman is a professional developer who knew what social engineering looks like. He still got caught. The attack was, in his words, "extremely well coordinated." When state-backed hackers spend six months building a fake company just to get your npm password, the usual "don't click suspicious links" advice doesn't cut it.

The open-source ecosystem's single points of failure (individual maintainers with publish access to packages used by millions) are now active targets of nation-state intelligence operations. That's the world we're in now.