How we caught the Axios supply chain attack
ID: 085d21d0-4906-5e67-9ab5-472d874857af
STIX ID: report--085d21d0-4906-5e67-9ab5-472d874857af
Feed Name: Elastic Security Labs
Threat Score
An Elastic researcher describes how an AI-driven package-diffing monitor detected an active supply-chain compromise of the npm package axios (malicious versions 1.14.1 and 0.30.4) that introduced a phantom dependency executing a postinstall cross-platform RAT; the report contextualizes this event within a broader campaign (Trivy → LiteLLM → Telnyx → Axios), attributes activity to a suspected DPRK actor, details the detection and response, and announces the open-source supply-chain-monitor tool.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.