# UNC1069/Axios: North Korean Supply Chain Compromise via Maintainer Account

- **Artifact ID:** CHQ-EX-2026-015
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-015
- **Machine-record SHA-256:** `3ffba67dc9f41ae8d5abed79c41b1f5527be30d714e551f709fb417badd64c9e`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-015",
  "title": "UNC1069/Axios: North Korean Supply Chain Compromise via Maintainer Account",
  "subtitle": "North Korean-nexus threat actor compromised the npm maintainer account for the Axios JavaScript library and published backdoored versions that executed a remote access payload through the normal installation path across 100 million weekly download environments.",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, exploitation mechanics, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (MARCH 31, 2026)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "EXHIBIT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2026-03-31",
    "temporal_end": "2026-03-31"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Threat Actor: UNC1069, tracked by Google’s Threat Intelligence Group as a financially motivated North Korean-nexus threat actor active since at least 2018. Microsoft attributes the same infrastructure to Sapphire Sleet. Known for targeting software build environments and developer credential theft.",
        "Compromise Mechanism: On March 31, 2026, between 00:21 and 03:20 UTC, an attacker compromised the npm account of the primary Axios maintainer (jasonsaayman). The registered email address was changed to an attacker-controlled ProtonMail address. The attacker bypassed the normal GitHub Actions OIDC-based CI/CD publishing workflow by using a long-lived access token to publish directly via the npm CLI.",
        "Payload: Two backdoored versions were published: axios@1.14.1 (tagged latest) and axios@0.30.4 (tagged legacy). Both introduced a phantom dependency, plain-crypto-js@4.2.1, published 18 hours before the attack and never imported by legitimate Axios code. The dependency executed automatically through npm’s postinstall hook on installation, without user interaction. The payload deployed WAVESHAPER.V2, a cross-platform remote access trojan targeting Windows, macOS, and Linux, delivered via a multi-stage dropper that resolved the final payload from a domain registered 72 hours before the attack.",
        "Exposure Window: Malicious versions were live for approximately three hours before detection and removal. During that window, the packages were downloaded by approximately 3% of the Axios userbase according to Wiz. Within Huntress’s partner base, 135 endpoints were observed contacting the attacker’s command-and-control infrastructure.",
        "Post-Compromise Capability: On every compromised host, the RAT performed immediate system reconnaissance, enumerating user directories, filesystem drive roots, and running processes, transmitting this data to the C2 server. The RAT maintained a 60-second beacon loop ready to accept commands including arbitrary script execution and in-memory binary injection. On Windows hosts, persistence was established to survive reboots and re-download the payload on every user login.",
        "Attribution: Google GTIG attributed the campaign to UNC1069 based on use of WAVESHAPER.V2, infrastructure overlaps with prior UNC1069 activity, and the compromised account’s email change to the same attacker-controlled address used in prior operations. Microsoft independently attributed the infrastructure to Sapphire Sleet."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "The campaign demonstrates that the npm publishing model treats credential possession as sufficient proof of publisher legitimacy. No registry architecture independently verified that the publishing action was authorized by the legitimate maintainer. The credential was both the proof of identity and the target of theft.",
        "The postinstall hook is the structural execution surface. npm executes postinstall scripts automatically during package installation. There is no user confirmation step. There is no verification that the script’s behavior is consistent with the package’s declared function. Any package that reaches the registry can execute arbitrary code on any machine that installs it, through a mechanism that is a documented and intended feature of the package manager.",
        "The three-hour exposure window produced durable compromise. Developer workstations and CI/CD runners that installed the affected versions during the window should be treated as fully compromised credential environments regardless of whether the malicious packages are still present. The RAT established persistence, beaconed to C2, and transmitted system reconnaissance before the packages were removed. Removal of the package does not remove the payload or reverse the reconnaissance.",
        "The concurrent timing with TeamPCP is analytically significant. Two independent threat actors exploited the same structural surface, the trusted software distribution channel, in the same reporting window using different mechanisms. This is not coincidence producing a notable event. It is independent actors converging on the same attack surface because the surface is structurally reliable as an entry point."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-SM-2026-012 — Memoranda: The Developer Supply Chain Is Now Self-Propagating (updated v1.1).",
        "CHQ-P-2026-004 — Position: Update Channels as Ungoverned Trust Execution Surfaces.",
        "CHQ-P-2026-015 — Position: Execution Pipelines Function as Control Planes Without Verification Primitives Capable of Validating the Authority They Execute.",
        "CHQ-ED-2026-016 — Evidence Docket: CHQ-P-2026-013 (Portable Developer Identity Cannot Contain Credential Compromise Across Registries)."
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: March 31, 2026. Exhibit issuance date is April 7, 2026. This Exhibit records findings as reported by named security research organizations, not as established fact.\n\nSources: Google Threat Intelligence Group, Microsoft Security Blog, Huntress, Help Net Security, SecurityWeek, Tenable, Cisco Talos.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-04-07"
}
```