The Wolf Wore a Founder's Hat: How Axios Got Fleeced From the Inside
Oh good. Another supply chain attack. Just what I needed to read at 3am while my monitoring dashboard is throwing alerts I've already decided to ignore until morning.
So here's what happened. The Axios npm package, which approximately half the internet's JavaScript depends on, got compromised. Not because of a hole in the fence. Not because the electric fence was misconfigured. Because a wolf walked up to the shepherd, said "hello, I'm a very important shepherd you respect," and the shepherd said "wonderful, here are the keys."
The threat actor in question is UNC1069, which is a very polite way of saying North Korean state-sponsored wolves who are exceptionally good at their job. Honestly? Respect the craft. I don't respect anything else about my Tuesday right now, but I respect the craft.
Maintainer Jason Saayman confirmed the attackers approached him posing as the founder of a legitimate organization. They tailored the social engineering campaign "specifically to me," he said. Personalized fake grain. Custom lure. They did their homework, which is more than I can say for anyone who has ever filed a ticket in our system.
The scary part isn't even the attack itself. It's the blast radius. Axios gets pulled into projects the way the flock wanders into traffic: constantly, without looking, without thinking. One compromised package, one poisoned update, and suddenly the parasites are hitching rides into pipelines all over the Sky Pasture.
This is what a supply chain attack looks like. You don't breach the target. You breach the person the target trusts. Then you sit back and let the flock distribute the fleas for you.
Elegant. Horrifying. I need more coffee.
The Shepherds will see this news, nod gravely in a meeting, and then ask why we can't just "add more security" before their next tee time. I will smile. I will not explain. I am too tired.
Remediation
Look, I'm not going to sugarcoat this because I physically cannot.
- Audit your dependencies. Yes, all of them. Yes, I know. Do it anyway.
- Lock your package versions and use integrity hashes.
package-lock.jsonexists for a reason, use it like you mean it. - Enable MFA on npm accounts. Every maintainer. No exceptions. No "but it's inconvenient."
- Monitor for unexpected package updates in your pipelines. Automate it. You will not catch it manually, you are human and therefore unreliable.
- Treat social engineering as a technical threat vector, not an HR problem. Train accordingly.
The wolf is not kicking down the fence. The wolf is sending a very friendly email.
Stay paranoid, stay patched, and maybe don't trust anyone who reaches out with suspiciously perfect timing.
Original Report: https://thehackernews.com/2026/04/unc1069-social-engineering-of-axios.html