Axios Supply Chain Attribution Confirmed: Microsoft Ties Sapphire Sleet to 70M-Download npm Backdoor

Analysis

Microsoft Formally Attributes Axios npm Compromise to Sapphire Sleet (North Korean APT)

Microsoft Threat Intelligence has officially tied the Axios npm backdoor to Sapphire Sleet, a North Korean state actor targeting crypto and finance since 2020. This is the definitive attribution post with full IOCs, defender detections, and step-by-step mitigation guidance for affected orgs.

Phoenix Security: Full RAT Anatomy Including AES-256 Exfiltration and Crypto Wallet Targeting

Phoenix Security goes deepest on the credential harvesting scope, which extends to Kubernetes tokens, Terraform state files, crypto wallets, and shell history. The StepSecurity Harden-Runner trace that confirms the RAT orphaned itself to PID 1 within 1.1 seconds of npm install is particularly striking.

Emergence AI CISO Breaks Down the Eight Controls That Would Have Blocked This Attack

A practical, no-fluff list of exactly what a hardened engineering org does differently: OIDC workload identity instead of long-lived tokens, postinstall scripts disabled in CI, 72-hour package release cooldown, and SLSA provenance checks. Concrete and replicable by any team today.

Tools

Snyk: How the Axios Dropper Works and Exactly How to Check Your Exposure

Snyk's breakdown is the most actionable for developers, covering the double-obfuscated dropper mechanics, Bun lockfile edge cases, and ready-to-run shell commands to confirm whether plain-crypto-js ever executed in your environment. If you only share one technical post with your team, this is it.