Axios npm RAT: What the Agentic AI Supply Chain Angle Changes

Analysis

Microsoft Formally Attributes Axios npm RAT to Sapphire Sleet with Full Defender Playbook

Microsoft's write-up is the most authoritative technical breakdown available, confirming North Korean APT Sapphire Sleet behind the attack and providing platform-specific IOCs, hunting queries, and step-by-step remediation. If your team hasn't reviewed the registry run key persistence mechanism on Windows and the self-erasing setup.js logic, this is the document to read.

Why AI Coding Agents Running npm install Autonomously Make This Attack Category Permanently Dangerous

This piece connects the Axios RAT to a risk most post-mortems ignore: AI coding agents like Claude Code and Cursor pull npm packages without human approval, meaning a compromised package with a postinstall hook can deploy a RAT with zero human interaction. It is the clearest framing of why supply chain hardening is now an agentic AI security problem, not just a DevOps checklist item.

Emergence AI CISO Publishes the Exact Internal Controls That Would Have Blocked the Axios Attack

The Emergence CISO post is unusually specific about what actually works, covering OIDC workload identity replacing long-lived tokens, 72-hour package age policies, and outbound connection monitoring in build environments. Treat this as a practical implementation checklist rather than a retrospective.

Tools

Snyk's Axios Incident Breakdown Includes Bun Lockfile Detection and Zero Day Report Workflow

Snyk adds practical detection commands for Bun users that most other write-ups skip entirely, which matters because Bun adoption in CI is accelerating. The step-by-step lockfile grep commands and the --ignore-scripts CI fix are the most copy-pasteable remediation guide available.