Beyond Axios: What the npm RAT Attack Reveals About Open Source Trust

Analysis

Microsoft Attributes Axios npm Compromise to North Korean Sapphire Sleet Actor

Microsoft Threat Intelligence formally pins the axios backdoor on Sapphire Sleet, a North Korean state actor, tying the C2 infrastructure to known DPRK tooling. This escalates the incident from opportunistic supply chain hit to targeted nation-state operation, which changes the threat model for any org that pulled the compromised versions.

Datadog Security Labs: Full Technical Teardown of the Axios RAT Attack Chain

Datadog's researchers note that the Windows and Linux RAT payloads both contain bugs that limit effectiveness, and that the Linux payload crashes in containerized environments. The real takeaway is how close this came to being much worse, and that most teams would not have caught it without automated dependency scanning.

How the Axios Maintainer Account Was Hijacked and CI/CD Bypassed Entirely

The attacker published malicious versions manually via a stolen long-lived npm access token, completely bypassing axios's GitHub Actions OIDC Trusted Publisher pipeline. If your security posture assumes CI/CD integrity equals package integrity, this is a direct counterexample worth studying.

Axios Attack Timeline: Socket Flagged the Malicious Dependency Six Minutes After Publication

Socket's automated detection caught the malicious plain-crypto-js package within six minutes of it going live, but axios@1.14.1 still shipped 22 minutes later because the registry had no automated hold. The gap between detection and prevention is the real problem this incident puts on the table.

News

Wiz: Axios Is Present in 80% of Cloud Environments, 3% Saw Active Execution

Wiz's cloud-scale telemetry puts hard numbers on the blast radius: axios sits in roughly 80% of cloud and code environments, and they observed actual execution of the malicious payload in 3% of affected environments. That 3% figure is the number defenders should be reporting up to leadership right now.