Axios Supply Chain Post-Mortem: Every IOC, Payload, and Hardening Step in One Place

Analysis

Microsoft Attributes Axios npm RAT to Sapphire Sleet with Full Kill Chain

Microsoft Threat Intelligence formally pins the Axios npm compromise on Sapphire Sleet, a North Korean state actor targeting crypto and finance. The write-up includes C2 infrastructure details, OS-specific payload hashes, and step-by-step mitigation guidance you can act on immediately.

Orca Security's Axios Technical Teardown: Phantom Dependency, Anti-Forensic Cleanup, and IOCs

Orca's write-up is the most detailed breakdown of how the phantom dependency trick worked and how the dropper erased its own tracks by swapping package.json after execution. If you want to understand exactly why post-incident npm inspection showed nothing suspicious, this is the piece to read.

Phoenix Security's Axios RAT Deep Dive: AES-256 Exfiltration, Credential Sweep Targets, and Runtime Validation

Phoenix Security adds detail on credential harvesting scope that other write-ups skip, including Kubernetes tokens, Terraform state files, crypto wallets, and shell history. Their runtime validation section confirms the C2 callback fires 1.1 seconds into npm install, before the process even returns to your terminal.

Tools

Snyk's Axios Compromise Breakdown: Lockfile Defense, Bun Support, and Zero-Day Reporting

Snyk caught the malicious plain-crypto-js dependency within 6 minutes of publication and has detailed detection steps for npm, yarn, and Bun lockfiles. Their enterprise Zero Day report feature gives you a system-wide view of affected projects, which is exactly the kind of signal you want at 3am UTC.