North Korean APT Axios Attribution: Snyk, Phoenix, and Orca Complete the Picture

Analysis

Snyk's Full Breakdown of the Axios Supply Chain Compromise and RAT Delivery Chain

Snyk confirms the attack vector, documents platform-specific RAT payloads, and provides actionable lockfile checks including Bun-specific detection steps most other writeups skipped. The Bun coverage alone makes this worth reading if your team uses it in CI.

Phoenix Security Documents Credential Harvesting Scope: SSH, Cloud Tokens, Crypto Wallets All Targeted

Phoenix Security's writeup is the most complete inventory of what the RAT actually sweeps, covering AWS, GCP, Azure, Kubernetes tokens, Terraform state files, and crypto wallet keyfiles in one place. If you need to scope a breach investigation, this is the checklist.

Orca Security Traces How the Maintainer Account Was Taken Over and Trusted Publishing Was Bypassed

Orca's breakdown focuses on the forensic signal that separated legitimate axios releases from the malicious ones: the absence of OIDC provenance metadata and a missing GitHub commit trail. This is the detection primitive every registry and CI system should be checking.

Emergence AI CISO Publishes Exact Controls That Would Have Blocked the Axios Attack

This is the most practical post-mortem for builders: exact version pinning, frozen lockfile installs, disabled postinstall scripts, OIDC workload identity, and a 72-hour release age policy are called out as the specific controls that would have stopped each stage. Copy this list into your security backlog.

News

Microsoft Attributes Axios npm Compromise to Sapphire Sleet, a North Korean State Actor

Microsoft Threat Intelligence formally ties the Axios attack infrastructure to Sapphire Sleet, the DPRK group focused on cryptocurrency theft and financial sector espionage. The attribution changes the threat model for any org in crypto, VC, or blockchain that ran npm install during the window.