Google links axios supply chain attack to North Korean group

Researchers report a supply-chain attack on the widely used npm package axios in which attackers hijacked a maintainer account to publish malicious package versions that deployed a multi-stage RAT across Windows, macOS, and Linux. Google Threat Intelligence and others attribute the activity to a North Korean actor (UNC1069); the malware executed, exfiltrated data, persisted, then replaced itself with legitimate files to evade detection, creating a broad and sophisticated risk to organizations that depend on axios.