npm Security Wake-Up Call: Dependency Hygiene, Credential Hygiene, and the Sapphire Sleet Attribution

Analysis

Microsoft Attributes Axios npm Attack to North Korean Sapphire Sleet

Microsoft Threat Intelligence tied the axios compromise directly to Sapphire Sleet, a known North Korean state actor, making this a geopolitical supply chain incident, not just an opportunistic hack. If you are running axios 1.14.1 or 0.30.4, rotate secrets immediately and disable auto-updates since the RAT includes a hook that keeps trying to pull updates.

Datadog Security Labs: Axios RAT Technical Breakdown and Dependency Cooldown Fix

Datadog's deep dive is the most technically precise writeup available, covering the OIDC trusted publishing bypass, RAT behavior per OS, and the bugs in the Windows and Linux payloads that limited damage. The standout recommendation is enabling a dependency cooldown setting in your package manager so newly published versions are skipped for a window long enough for the community to catch compromises like this.

News

Wiz: Axios Present in 80% of Cloud Environments, 3% Showed Active Execution

Wiz's cloud-wide telemetry puts real numbers on the blast radius: axios was present in roughly 80% of scanned environments and active execution of the malicious versions was observed in 3% of those. That 3% figure is the signal to prioritize right now if you are running cloud workloads built on JavaScript.

Full Attack Timeline: How the Axios Maintainer Account Was Hijacked and Bypassed CI/CD

This writeup reconstructs the exact sequence from the pre-staged decoy package on March 30 through the npm security hold at 03:25 UTC, making it the clearest narrative for briefing non-technical stakeholders. The key forensic tell is that legitimate axios releases always carry OIDC provenance metadata and SLSA attestations, and the malicious versions had none.

Tools

IOCs and Remediation Checklist for the Axios npm Compromise

IronPlate's breakdown includes specific indicators of compromise and a structured remediation guide, which is useful if you are running incident response right now and need a checklist format. The plain-crypto-js phantom dependency is the primary artifact to hunt for across your lockfiles and build logs.