Axios npm Attack: Bitdefender Behavioral Blocks, Wiz Telemetry, and the 3% Execution Rate That Should Scare You

Analysis

Bitdefender: Wiz Telemetry Shows 3% RAT Execution Rate in Affected Axios Environments

Wiz observed the RAT actually executing in roughly 3% of environments where the compromised versions were present, and Bitdefender telemetry confirmed blocked execution attempts in the wild before any public reporting. That 3% number is the clearest signal yet of real-world impact beyond theoretical blast radius.

Datadog Security Labs: Full Account Takeover Forensics on the Axios Maintainer Compromise

Datadog reconstructed the exact account takeover using npm registry metadata, showing the maintainer email changed and OIDC trusted publishing was bypassed for a direct CLI publish. The dependency cooldown recommendation is the most actionable defensive takeaway here for teams running automated dependency updates.

Threat Intelligence

Microsoft Attributes Axios npm RAT Campaign to North Korean State Actor Sapphire Sleet

Microsoft Threat Intelligence formally attributes the C2 infrastructure and the plain-crypto-js package to Sapphire Sleet, a DPRK actor known for targeting crypto and finance orgs. The VPS provider Hostwinds is a recurring Sapphire Sleet infrastructure tell, which is worth adding to your network blocklists now.

Qualys: Google Threat Intelligence Tracks This Activity as UNC1069 Using WAVESHAPER.V2

Qualys surfaces Google GTIG's independent attribution to UNC1069, a DPRK-linked actor active since 2018, based on the WAVESHAPER.V2 backdoor variant used in the macOS payload. QIDs 386943 and 5010006 are available for automated scanning if you need to sweep enterprise asset inventories quickly.

Malware Analysis

Elastic Security Labs: Three Platform-Native RAT Implementations Sharing One Identical C2 Protocol

Elastic's teardown confirms the Windows PowerShell, macOS C++ binary, and Linux Python payloads are not separate tools but a single RAT spec with platform-native implementations, all sharing the same IE8/Windows XP user-agent string. That anachronistic user-agent on a macOS or Linux host is your easiest high-confidence detection signal.