North Korean Hackers Compromise Widely Used Axios Package to Infect Windows, macOS, and Linux Systems

Key Takeaways

• North Korean state-sponsored threat actors (UNC1069) compromised the widely used Axios NPM package in a supply chain attack.
• Malicious versions 1.14.1 and 0.30.4 of Axios, through a dependency called plain-crypto-js (versions 4.2.0 or 4.2.1), delivered the WAVESHAPER.V2 backdoor.
• The attack impacts Windows, macOS, and Linux systems, exploiting the package installation process to achieve widespread compromise.
• The WAVESHAPER.V2 backdoor enables extensive system control, data exfiltration, and persistent access.
• Organizations must immediately identify and isolate affected systems, revert to known-good Axios versions, and rotate credentials.

North Korean Hackers Exploit Axios NPM Package in Broad Supply Chain Attack

North Korean state-sponsored threat actors have executed a sophisticated software supply chain attack, leveraging the popular Axios NPM package to deploy malware across Windows, macOS, and Linux environments. This incident, detailed in a report from Google Cloud, involves the distribution of the WAVESHAPER.V2 backdoor via compromised versions of Axios: 1.14.1 and 0.30.4. These poisoned releases surreptitiously introduced a dependency, plain-crypto-js, which then facilitated the malware delivery during the standard installation process.

The severity of this incident is amplified by Axios’s widespread adoption as a critical library for HTTP requests in countless development projects. Its extensive use means that a single compromised package update could potentially expose a vast array of systems, including developer workstations, build servers, CI/CD pipelines, and downstream applications that rely on the integrity of official package streams.

Initial Compromise and Attribution

Google Cloud researchers, upon investigating the intrusion, determined that the attackers likely gained control of the Axios maintainer account. They subsequently altered the associated email address and injected plain-crypto-js version 4.2.1 into the package. The firm attributed this activity to UNC1069, a North Korea-linked threat actor known for its financially motivated campaigns, citing infrastructure overlaps and the use of the updated WAVESHAPER.V2 malware family, as detailed in their blog post.

A particularly insidious aspect of this campaign is its stealthy delivery mechanism. Rather than relying on traditional social engineering tactics like malicious links or attachments, the attackers exploited the normal NPM install process. They utilized a postinstall hook, enabling the dropper to execute in the background immediately upon the installation of the tainted Axios package, making detection challenging for unsuspecting developers.

Infection Chain Details

The infection sequence was orchestrated by an obfuscated JavaScript dropper, identified as setup.js (also tracked as SILKBELL by Google’s Threat Analysis Group (TAG)). Upon execution, this script performed an operating system check and delivered a tailored payload for each platform:

• Windows: The script located powershell.exe, duplicated it to an alternative directory to evade detection, then downloaded and executed a PowerShell stage using curl with hidden and execution-policy-bypass options.
• macOS: It leveraged bash and curl to install a Mach-O binary in /Library/Caches/com.apple.act.mond, adjusted file permissions, and initiated its launch via zsh.
• Linux: A Python backdoor was downloaded to /tmp/ld.py.

The malware also incorporated anti-forensic measures. Google’s analysis revealed that setup.js attempted to self-delete after deploying the subsequent stage and restore the modified package.json from a cached copy, complicating post-incident analysis.

The ultimate payload, WAVESHAPER.V2, established a command-and-control (C2) communication channel, beaconing to its server every 60 seconds over port 8000. These communications utilized Base64-encoded JSON and a hard-coded user-agent string.

WAVESHAPER.V2 grants the attackers extensive control beyond basic remote access. GTIG reported that the malware is capable of gathering system information, enumerating files and directories, executing arbitrary scripts, injecting or launching additional payloads, and awaiting further commands from the C2 server. On Windows systems, it also establishes persistence by creating a hidden batch file and adding a “MicrosoftUpdate” entry to the current user’s Run registry key, ensuring its execution at logon.

What You Should Do

• Avoid Compromised Versions: Immediately cease using and remove Axios versions 1.14.1 and 0.30.4.
• Pin to Safe Releases: Configure your projects to use known-good Axios releases, specifically 1.14.0 or earlier, and 0.30.3 or earlier.
• Inspect Lockfiles: Thoroughly review your project’s lockfiles (e.g., package-lock.json, yarn.lock, pnpm-lock.yaml) for any instances of plain-crypto-js versions 4.2.0 or 4.2.1.
• Assume Compromise: Any system that installed the malicious dependency should be considered compromised. Isolate these systems, rebuild them from a trusted image, or revert to a known-good state.
• Rotate Credentials: Following system remediation, rotate all credentials, API keys, tokens, and other sensitive secrets that may have been present on the affected hosts.
• Pause CI/CD: Temporarily halt any affected CI/CD jobs and pipelines.
• Clear Caches: Clear npm, yarn, and pnpm caches to prevent re-infection from cached malicious packages.
• Block Malicious Infrastructure: Implement network blocks for traffic to the identified command-and-control server domains and IP addresses, including sfrclak[.]com and 142.11.206.73.
• Monitor for Suspicious Activity: Continuously monitor for suspicious child processes originating from Node.js applications.
• Review Dependency Trees: Conduct a comprehensive review of your entire dependency tree for all projects, not just direct dependencies, to identify any inherited exposure to plain-crypto-js.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.