Axios Supply Chain Forensics: Attribution, Payload Bugs, and the npm Controls That Would Have Stopped It

Analysis

Qualys Attributes Axios RAT to North Korea-Nexus UNC1069 via WAVESHAPER.V2

Qualys pins the Axios compromise on UNC1069, a financially motivated North Korea-linked actor active since 2018, based on WAVESHAPER.V2 malware signatures. That attribution matters because it reframes this as a state-adjacent IAB operation, not an opportunistic script kiddie hit.

Datadog's Registry Forensics: How the Maintainer Account Takeover Left Traces in npm Metadata

Datadog shows exactly how the attacker's email swap and missing OIDC trusted-publisher field in npm registry metadata expose the account takeover in plain sight. The Linux payload also crashes in containers due to an os.getlogin() bug, limiting actual blast radius for CI/CD environments.

SANS: Why Pinned Lockfiles and CI Script Suppression Were the Only Controls That Actually Held

SANS confirms that organizations with committed lockfiles and pipelines blocking auto-install scripts were fully protected during the three-hour window. The broader warning is that TeamPCP likely holds a stockpile of publishing credentials and will run this playbook again on other high-download packages.

News

Sonatype: Malicious plain-crypto-js Spread Beyond Axios Into OpenClaw Packages

The same malicious dependency showed up in @qqbrowser/openclaw-qbot and multiple @shadanai/openclaw versions, confirming the attacker built a reusable delivery infrastructure rather than a one-shot hit. Sonatype flagged both packages within minutes, which is the actual case for automated firewall tooling at the registry layer.

Tools

Snyk's Builder Checklist: Lockfile Audits, --ignore-scripts, and What to Do If You Were Hit

Snyk lays out the exact grep commands to audit package-lock.json and bun.lock for affected versions, plus the npm ci --ignore-scripts flag that would have blocked the postinstall hook entirely. If you haven't run this on your CI pipelines yet, this is the most actionable piece in the current coverage.