A detailed recap of the March 2026 axios npm supply chain compromise, in which attackers gained access to the primary maintainer's account via social engineering (a fake Slack workspace and Microsoft Teams call) and published two backdoored releases (axios@1.14.1 and axios@0.30.4). The malicious payload — a cross-platform RAT attributed to North Korean threat actor UNC1069 — was delivered to macOS, Windows, and Linux systems within a three-hour window before removal. Huntress observed at least 135 endpoints contacting attacker C2 infrastructure. The post contextualizes the attack within a broader wave of npm supply chain compromises (including the Shai-Hulud worm and Trivy compromise) and offers mitigation advice: pin dependencies to verified versions, use private quarantine repos, apply age-based restrictions on new package versions, and apply the Clean Source Principle.
