SANS Joins the Axios Post-Mortem: TeamPCP, Credential Theft, and What Blue Teams Need to Check Now

Analysis

SANS: Axios NPM Compromise May Be Part of TeamPCP Supply Chain Campaign

SANS connects the Axios attack to TeamPCP, a threat actor that hit Trivy, KICS, LiteLLM, and Telnyx in rapid succession between March 19-27. If SANS is right that TeamPCP is operating as an Initial Access Broker with a stockpile of stolen publishing credentials, this is not over.

Orca Security: Full Axios Attack Flow With Anti-Forensic Evidence Destruction Timeline

Orca's breakdown adds an important detail: the malware replaced the incriminating package.json with a clean decoy within 36 seconds of execution, meaning npm audit shows nothing after the fact. The only reliable post-compromise indicator is the plain-crypto-js directory still existing in node_modules.

IronPlate: Why AI Coding Agents Running npm install Autonomously Expand the Axios Blast Radius

IronPlate makes the underappreciated point that agentic AI tools like Claude Code and Cursor run npm install without human review, meaning the RAT would have deployed on agent host machines with zero prompts. If your MCP server or AI coding environment has broad filesystem and network access, a compromised dev machine is a much bigger problem than usual.

Tools

Snyk: Axios RAT Exposed CI/CD Pipelines Running npm install Without Lockfile Enforcement

Snyk's write-up focuses on who was actually at risk: pipelines using caret ranges that ran npm install during the ~3 hour window, plus anyone depending on the secondary packages @qqbrowser/openclaw-qbot or @shadanai/openclaw which shipped the malicious dependency independently of the Axios window. If you use Bun, Snyk has a specific workaround since native bun.lock support is limited in their CLI.

News

Microsoft Attributes Axios npm Backdoor to Sapphire Sleet, Releases Defender Detections

Microsoft formally attributes the attack to Sapphire Sleet, a North Korean APT focused on crypto and finance, and confirms the C2 IP 142.11.206.73 is hosted on Hostwinds, a VPS provider the group habitually uses. Microsoft Defender detections are live and the post includes the full list of registry keys, file paths, and network indicators to hunt for.