Axios npm Supply Chain Breach: Microsoft Shares Mitigation Steps

Microsoft warns that two malicious Axios npm releases (1.14.1 and 0.30.4) contained a hidden install-time dependency that reached out to C2 infrastructure (sfrclak.com, IP 142.11.206.73) to download platform-specific RATs; activity is attributed to the North Korean group Sapphire Sleet. The compromise leverages npm lifecycle hooks to execute during npm install/update across developer workstations, CI/CD runners, and production systems, persisting on macOS, Windows, and Linux; Microsoft recommends rotating exposed secrets, downgrading to safe Axios versions, scanning for the affected packages and outbound connections, and hardening npm/CI publishing practices.