Axios npm RAT: Social Engineering Root Cause, Datadog's Registry Forensics, and Sonatype's Downstream Blast Radius

Analysis

Datadog Security Labs: How the Axios Maintainer Got Compromised and What npm Registry Metadata Reveals

Datadog traced the account takeover through npm registry API metadata, showing the publisher switched from GitHub Actions OIDC to a direct user session and the maintainer email changed to an attacker-controlled address mid-publish. The root cause was a fake Microsoft Teams call where the maintainer was social-engineered into installing the RAT themselves, a technique matching Google's documented playbook against open-source maintainers.

Sonatype: Axios Compromise Spread Beyond axios Itself via OpenClaw-Related Packages

Sonatype flagged the malicious packages within minutes and found the same plain-crypto-js payload appearing in additional OpenClaw-affiliated npm packages, meaning the blast radius extended well past axios. This confirms the attacker had a broader distribution strategy, not just a one-package hit.

Microsoft Security: Full Kill Chain and Mitigation Guide for Sapphire Sleet's Axios npm Attack

Microsoft's deep-dive confirms the RAT's persistence mechanism on Windows via a MicrosoftUpdate registry run key and details how the attacker used a clean dummy release of plain-crypto-js to establish publishing history before injecting the malicious version. The mitigation steps, especially pinning exact versions and running npm ci --ignore-scripts, are the most actionable guidance published so far.

SANS: Axios npm Compromise IOCs, Affected Package Hashes, and Blue Team Response Checklist

SANS provides the clearest incident response checklist, including exact file paths for RAT artifacts on each OS and the package hashes needed for lockfile auditing. Their note that forensic evidence is deliberately limited because the malware deletes itself and swaps its own package.json is a critical detail for scoping investigations.

News

Qualys: Google Threat Intelligence Attributes Axios RAT to UNC1069 Using Updated WAVESHAPER Implant

Qualys adds Google Threat Intelligence Group's attribution, linking the attack to UNC1069 (a North Korea-nexus actor) via the WAVESHAPER.V2 implant, which conflicts with Microsoft's Sapphire Sleet attribution and suggests either overlap between tracking clusters or multiple actors. The peinject command in the RAT enabling in-memory payload injection is worth flagging for defenders doing incident response.