Axios npm Attack Aftermath: What the Registry Metadata Told Us Before Anyone Else Did

Analysis

Datadog: How npm Registry Metadata Exposed the Axios Account Takeover Before Any Alert Fired

The registry API told the whole story before any security tool flagged it: the maintainer email flipped from Gmail to Proton, trusted publisher binding vanished, and the publish method switched from GitHub Actions OIDC to direct CLI. If you are not monitoring these metadata fields on critical packages, you are flying blind.

Elastic Security Labs: Three Platform-Native RAT Implementations, One Shared C2 Protocol

Elastic confirmed the Windows PowerShell, macOS C++, and Linux Python payloads are all implementations of the same RAT spec with identical beacon cadence, message format, and the anachronistic IE8 user-agent that trivially flags on macOS and Linux hosts. The shared design fingerprint points to a single coordinated developer rather than three separate tools bolted together.

Bitdefender: Pre-Staged Clean Package, 39-Minute Dual-Branch Strike, and Wiz 3% Execution Rate

Bitdefender lays out the operational planning behind the attack: a clean plain-crypto-js 4.2.0 decoy published 18 hours early to build registry history, then both the 1.x and 0.x release branches hit within 39 minutes. Wiz telemetry showing a 3% RAT execution rate across affected environments means the blast radius was real, not theoretical.

News

Microsoft Attributes Axios npm Compromise to Sapphire Sleet, Issues Cross-Platform IOCs

Microsoft Threat Intelligence pins the attack on Sapphire Sleet, the North Korean actor that primarily targets crypto and fintech via social engineering, using infrastructure on a Hostwinds VPS they have been seen using before. The blog covers the full Windows persistence chain including the MicrosoftUpdate registry run key and gives exact npm commands to block reinstall of the malicious hook.

Qualys Links Axios RAT to UNC1069 via WAVESHAPER.V2 and Publishes Detection QIDs

Google Threat Intelligence Group assigned the activity to UNC1069, a DPRK-linked financially motivated actor, based on WAVESHAPER.V2 overlap with the macOS Mach-O payload. Qualys customers can sweep for exposure with QIDs 386943 and 5010006, the latter requiring SwCA to be enabled.