North Korea's UNC1069 Turns Axios NPM into Cross-Platform Trapdoor
Google's just named North Korea's UNC1069 as the crew behind the Axios npm hijack. It's a slick supply chain play, dropping cross-platform backdoors on devs worldwide.
β‘ Key Takeaways
- UNC1069 used a postinstall hook in plain-crypto-js for stealthy, cross-platform backdoor deployment via compromised Axios.
- WAVESHAPER.V2 evolves prior malware with JSON C2, more commands, tying directly to North Korean ops since 2018.
- Audit deps now: Pin Axios, block sfrclak.com, scan for traces β npm's trust model demands it.
π§ What's your take on this?
Cast your vote and see what Threat Digest readers think
Worth sharing?
Get the best Cybersecurity stories of the week in your inbox β no noise, no spam.
Originally reported by The Hacker News
Related Stories
Security Tools
Iran's April 1 Deadline Puts Apple, Google in Crosshairs
Security Tools
Chrome's Fifth Zero-Day Patch: Google Races Against Relentless Exploits
Security Tools
IRGC Puts Apple, Google, Tesla on Middle East Hit List for April 1 Attacks
Security Tools