Supply Chain Trust Is Broken: The Axios Post-Mortem Every Builder Needs to Read

Microsoft Attributes Axios npm Compromise to North Korean Sapphire Sleet APT

Microsoft Threat Intelligence formally pins the Axios backdoor on Sapphire Sleet, a North Korean state actor known for targeting crypto and finance. The C2 infrastructure at sfrclak[.]com ties directly to Hostwinds VPS infrastructure this group has used before, giving defenders a concrete IOC cluster to block. If you run any JavaScript stack, rotate secrets and audit your CI logs for the affected window now.

Snyk's Full Technical Teardown: How the Axios RAT Was Built and Deployed

Snyk walks through the double-obfuscated dropper, the phantom dependency staging trick using plain-crypto-js, and the three-hour exposure window that hit CI/CD pipelines hardest. The practical lockfile audit commands and Bun-specific detection steps make this the most actionable single resource for developers checking their own exposure.

Orca Security: How the Axios Maintainer Account Was Taken Over and What the Dropper Did

Orca breaks down the forensic tell that caught the attack: legitimate Axios releases carry OIDC Trusted Publisher attestations, the malicious 1.14.1 had none. The phantom dependency trick and anti-forensic evidence destruction (setup.js deleting itself and swapping in a clean package.json) are detailed clearly for defenders building detection rules.

Phoenix Security: Credential Harvesting Scope of the Axios RAT Was Broader Than Reported

Phoenix Security documents the full credential sweep: SSH keys, AWS/GCP/Azure creds, Kubernetes tokens, .env files, crypto wallets, and shell history all targeted with AES-256-CBC plus RSA-4096 encrypted exfiltration. Any CI runner that hit npm install during the window should be treated as a full breach, not just a dependency issue.