Axios Attack Shows How Complex Social Engineering Is Industrialized

The report details a social‑engineering supply‑chain compromise of the Axios NPM package attributed to a suspected North Korean actor (UNC1069). Attackers conducted a prolonged, convincing social‑engineering campaign that deceived the lead maintainer into installing a RAT, published malicious package versions to NPM, and briefly distributed them before removal; the incident underscores the scalability and high impact of targeting open‑source maintainers given Axios’ large download footprint.