Axios RAT: Microsoft's Sapphire Sleet Attribution, Snyk's Breach Playbook, and the npm Controls That Would Have Blocked It

Analysis

Microsoft Attributes Axios npm RAT to North Korea's Sapphire Sleet

Microsoft Threat Intelligence officially pins the Axios npm compromise on Sapphire Sleet, a North Korean state actor known for targeting crypto and finance. The blog details the C2 infrastructure, OS-specific payload delivery, and the VPS provider (Hostwinds) the actor consistently uses, giving defenders concrete attribution and IOCs to act on.

Snyk's Axios Compromise Playbook: Lockfile Forensics, IOC Checklist, and Assume-Breach Steps

Snyk's writeup is the most actionable defender guide so far, with exact grep commands to audit lockfiles, per-platform IOC tables, and a clear assume-breach rebuild checklist. The point about lockfile enforcement being the first line of defense is worth internalizing for any team running npm in CI.

Datadog's Registry Forensics: How the Compromised Publisher Email Exposed the Account Takeover

Datadog's technical deep-dive shows exactly how npm registry metadata revealed the account takeover, with the publisher email flipping from a Gmail address to a Proton Mail address between versions 1.14.0 and 1.14.1. The detail about the Linux payload crashing in containerized environments due to os.getlogin() is a useful operational weakness defenders can use to assess actual exposure in container-heavy CI environments.

News

Sonatype Tracks Axios Malware Spreading Beyond Axios Into OpenClaw Packages

Sonatype flagged the malicious packages within minutes and identified downstream spread into OpenClaw-related npm packages, showing the blast radius extends beyond Axios itself. The observation that attackers don't need to touch trusted code when they can poison the trust around it is the right framing for supply chain risk in 2026.

Threat Intelligence

Google's GTIG Assigns Axios RAT to UNC1069, Links Payload to WAVESHAPER.V2

Qualys surfaces a key attribution detail from Google Threat Intelligence Group: the activity maps to UNC1069 and uses WAVESHAPER.V2, an updated version of a known implant tied to this threat cluster. This cross-vendor attribution convergence on the same North Korean actor strengthens the signal for enterprise defenders building threat models.