Axios Breach Blamed on North Korea: The Full Sapphire Sleet Kill Chain and What Builders Must Do

Analysis

Microsoft Attributes Axios npm RAT to Sapphire Sleet, Publishes Full Mitigation Guide

Microsoft Threat Intelligence formally ties the Axios npm backdoor to Sapphire Sleet, the North Korean state actor known for targeting crypto and finance. The blog covers the full kill chain from dependency injection to cross-platform RAT deployment, with specific mitigations including disabling npm auto-updates and rotating all secrets on affected systems.

Snyk's Technical Breakdown of the Axios Supply Chain Attack and How to Detect Exposure

Snyk walks through how the phantom plain-crypto-js dependency worked, how the dropper self-erased after execution, and gives concrete CLI commands to check lockfiles and node_modules for compromise indicators. If you run JavaScript anywhere in your stack, the verification steps here are worth running today.

IronPlate: Complete IOC List, Attack Timeline, and Why AI Coding Agents Are a New Attack Surface

IronPlate adds a useful angle most post-mortems miss: AI coding agents like Claude Code and Cursor that auto-run npm install could have silently triggered the RAT with zero human approval. The full IOC table and 18-hour pre-staging timeline are the most detailed reconstruction available.

Emergence AI CISO: The Exact Controls That Would Have Blocked the Axios Attack

The Emergence AI CISO lists the specific controls their team runs, including exact version pinning enforced in CI, postinstall scripts disabled by default, and a 72-hour package release cooldown policy. This is the most actionable organizational checklist to come out of the incident.

Research

Phoenix Security: Full Credential Harvesting Scope and Encrypted Exfiltration Details

Phoenix Security digs deepest into what the RAT actually stole, covering SSH keys, Kubernetes tokens, Terraform state files, crypto wallets, and shell history, all encrypted with AES-256-CBC and RSA-4096 before exfiltration. The StepSecurity Harden-Runner process tree showing C2 contact 1.1 seconds into npm install is a striking proof of how fast this executed.