🛡️ Security Tools

North Korea Poisons Axios NPM with RATs in Bold Supply Chain Hit

A single hijacked maintainer turned Axios—the JS HTTP king with 100 million weekly downloads—into a RAT delivery vehicle. North Korean actors bet big on supply chain chaos, and it almost paid off.

James Kowalski 📅 Apr 03, 2026 ⏱️ 4 min read 👁️ 0 views
Hacker injecting malware into Axios npm package code with North Korean flag overlay

⚡ Key Takeaways

  • Axios hijack via maintainer compromise spreads cross-platform RATs to millions of projects.
  • Check lockfiles immediately for v1.14.1, v0.30.4, or plain-crypto-js—Google warns of huge blast radius.
  • North Korea's UNC1069 eyes supply chains; expect provenance mandates to combat this.

🧠 What's your take on this?

Cast your vote and see what Threat Digest readers think

James Kowalski
Written by

James Kowalski

Investigative tech reporter focused on AI ethics, regulation, and societal impact.

#RAT malware #axios npm hijack #npm malware #supply chain attack #unc1069

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by InfoSecurity Magazine

Related Stories

📬

Stay in the loop

The week's most important stories from Threat Digest, delivered once a week.

No spam. Unsubscribe any time.