Supply Chain Trust Is Broken: Lessons from the Axios npm Compromise

Threat Intelligence

Microsoft Attributes Axios npm Compromise to North Korean Sapphire Sleet

Microsoft Threat Intelligence confirmed the axios attack was carried out by Sapphire Sleet, a North Korean state actor, marking a significant escalation in state-sponsored supply chain targeting of JavaScript infrastructure. If you have axios 1.14.1 or 0.30.4 in any environment, rotate credentials immediately and downgrade to 1.14.0 or 0.30.3.

Analysis

Datadog Security Labs: Full Technical Breakdown of the Axios RAT Attack Chain

The best deep-dive available on how the attack worked, including the OIDC trusted publishing bypass, the trojanized plain-crypto-js dependency, and OS-specific RAT payload behavior. Notably, the Windows and Linux RAT variants had bugs limiting their effectiveness, but that is cold comfort for anyone who ran npm install during the 3-hour exposure window.

Wiz: Axios Present in 80% of Cloud Environments Made This Attack Uniquely Dangerous

Wiz's data shows axios is present in roughly 80% of cloud and code environments, which explains why even a 3-hour compromise window resulted in observed execution across 3% of affected environments. The scale here is not hypothetical, actual production workloads were running malicious code.

News

Emergence AI CISO Advisory: Attack Timeline and What to Check in Your Pipeline

A practical incident response framing that lays out the exact UTC timestamps for each stage of the attack, useful for auditing whether your CI/CD jobs were exposed. The phantom plain-crypto-js dependency with no corresponding code references is a clean detection signal to query in your environments.