Trending Now - North Korean Group UNC1069 Linked to Axios NPM Breach

WHO:

The Hacker News - Google Threat Intelligence Group (GTIG) chief analyst John Hultquist attributed the attack to a North Korean threat activity cluster tracked as UNC1069.

The Hacker News - The malicious versions of the axios package were published by unidentified threat actors who seized control of the package maintainer's npm account.

WHAT:

axios - The axios HTTP client library has over 100 million weekly downloads.

axios - Two malicious versions of the axios library, axios@1.14.1 and axios@0.30.4, were identified on March 30, 2026.

The Hacker News - The malicious dependency introduced by the compromised versions is named plain-crypto-js@4.2.1.

The Hacker News - The backdoor, codenamed WAVESHAPER.V2, is an updated version of a previous backdoor deployed by UNC1069.

The Hacker News - WAVESHAPER.V2 supports four commands: kill, rundir, runscript, and peinject.

WHERE:

The Hacker News - The command-and-control (C2) server for the malware is located at the domain sfrclak[.]com and IP address 142.11.206[.]73.

The Hacker News - The malware is capable of infecting Windows, macOS, and Linux systems.

WHEN:

axios - The malicious versions of axios were published on March 30, 2026.

The Hacker News - UNC1069 has been operational since 2018.

WHY:

The Hacker News - The attack is attributed to financially motivated North Korean hackers who have historically used supply chain attacks to steal cryptocurrency.

HOW:

The Hacker News - The attack leverages a postinstall hook within the "package.json" file of the malicious dependency to achieve stealthy execution.

The Hacker News - The malicious package functions as a "payload delivery vehicle" for an obfuscated JavaScript dropper named SILKBELL ("setup.js").

The Hacker News - The dropper fetches the next-stage payload from a remote server based on the victim's operating system.

The Hacker News - The malware performs a cleanup to remove itself and replaces the "plain-crypto-js" package's "package.json" file with a clean version.

(UPDATED April 1, 2026 23:11 UTC)

A recent cyber attack attributed to North Korean hackers has compromised two malicious versions of the popular axios HTTP client library, which boasts over 100 million weekly downloads. These versions, identified as axios@1.14.1 and axios@0.30.4, were published on Monday, and introduce a backdoor known as WAVESHAPER.V2, capable of infecting Windows, macOS, and Linux systems through a stealthy execution method. The command-and-control server for this malware is located at sfrclak.com, and the attack leverages a postinstall hook to deliver its payload, which includes an obfuscated JavaScript dropper that fetches further malicious content based on the victim's operating system.