North Korean Hackers Breach Axios Package, Target Windows, macOS, and Linux Systems

A North Korea‑nexus threat actor (tracked as UNC1069) hijacked the Axios NPM package on March 31, 2026, publishing backdoored releases that added a malicious dependency (plain-crypto-js) which runs a postinstall dropper (SILKBELL) to fetch and deploy a cross‑platform RAT (WAVESHAPER.V2) on Windows, macOS, and Linux; the report includes attribution, IOCs (C2 domains/IPs and URLs), and mitigation guidance such as auditing installs, rotating CI/CD secrets, and strengthening maintainer account protections.