Microsoft Details Steps to Mitigate the Axios npm Supply Chain Compromise

A supply-chain attack compromised two Axios npm releases by adding a malicious dependency ([email protected]) which executed a post-install loader to download platform-specific RATs (Windows, macOS, Linux); Microsoft attributes the infrastructure to North Korean APT 'Sapphire Sleet' and recommends immediate rollback to 1.14.0/0.30.3, rotating exposed secrets, locking package versions, cleaning npm cache, auditing CI/CD logs, and blocking the C2 domain and IP.