Axios npm RAT: The North Korean Kill Chain Rebuilt From First Principles

Microsoft Formally Attributes Axios npm Backdoor to North Korean APT Sapphire Sleet

Microsoft Threat Intelligence connected the C2 infrastructure to Sapphire Sleet (also tracked as BlueNoroff/UNC1069), a North Korean group focused on crypto theft and financial espionage. The blog includes full IOCs, Defender detections, and a step-by-step mitigation checklist you can run today.

Snyk's Axios Compromise Breakdown: Timeline, Lockfile Defense, and Detection Commands

Snyk's writeup is the most actionable for developers, with exact grep commands to check lockfiles, bun.lock handling, and per-platform IOC checks. The key callout: lockfile enforcement would have blocked this entirely for any project not running npm install fresh during the 3-hour window.

Orca Security's Technical Teardown: How the Phantom Dependency and Self-Erasing Dropper Actually Worked

Orca goes deep on the anti-forensic cleanup mechanic, where setup.js deletes itself and swaps in a clean package.json so post-infection inspection finds nothing suspicious. The breakdown of the XOR obfuscation layer and how C2 traffic was disguised as npm registry calls is worth reading for anyone building detection rules.

Phoenix Security's Full Kill Chain: Credential Harvesting Targets, RAT Persistence, and CI/CD Blast Radius

This writeup is the most comprehensive on what the RAT actually stole: SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, .env files, crypto wallets, and shell history, all encrypted with AES-256-CBC and RSA-4096 before exfil. If a CI/CD pipeline hit the window, treat every secret on that runner as fully compromised.