Sapphire Sleet's Axios Playbook: Inside the RAT That Hit 400M Monthly Downloads

Microsoft Attributes Axios npm Compromise to North Korean Sapphire Sleet

Microsoft Threat Intelligence formally attributed the axios RAT campaign to Sapphire Sleet, a North Korean state actor focused on crypto theft and financial espionage. The C2 infrastructure at sfrclak.com ties directly to Hostwinds VPS infrastructure this group is known to abuse, and the multi-platform RAT design matches their operational pattern.

Orca Security: Full Technical Breakdown of the Axios Supply Chain Attack

Orca's writeup is the most forensically complete public account of the attack, covering the phantom dependency trick, the two-layer XOR obfuscation in setup.js, platform-specific payload delivery, and the anti-forensic package.json swap that makes post-incident inspection look clean. If you are doing incident response on this, start here.

Phoenix Security: Credential Harvesting Scope and Encrypted Exfiltration Details

Phoenix Security's report goes deepest on what the RAT actually stole: SSH keys, AWS and GCP credentials, Kubernetes tokens, .env files, crypto wallets, and shell history, all encrypted with AES-256-CBC and RSA-4096 before exfiltration. The StepSecurity runtime validation confirming C2 contact 1.1 seconds into npm install is the scariest data point in any of these writeups.

Hive Security: TeamPCP Hit Five Open Source Projects in 13 Days Before Axios

Hive Security maps the full TeamPCP campaign timeline: Trivy, KICS, LiteLLM, Telnyx, then Axios, all hit within 13 days and all targeting developer tooling rather than end-user apps. The IAB framing matters here because the goal was not ransomware or crypto mining but persistent access to sell downstream to other threat actors.

Emergence AI CISO: Eight Controls That Would Have Blocked the Axios Attack

Practical list from a CISO who has dealt with this class of attack before: exact version pinning, frozen lockfile CI installs, postinstall scripts disabled with --ignore-scripts, OIDC provenance requirements, and a 72-hour package release cooldown policy. The cooldown policy is the underrated one since the malicious plain-crypto-js package would have been caught before entering any pipeline that enforced it.