North Korea’s hijack of one of the web’s most used open source projects was likely weeks in the making

A suspected North Korean state-backed campaign compromised the popular Axios open-source project by building trust via fake company profiles and a Slack workspace, tricking the maintainer into installing malware during a web meeting and then publishing two malicious Axios packages (pulled ~3 hours later). The brief supply-chain attack may have exposed private keys, credentials, and passwords for systems that installed the compromised releases, illustrating sophisticated social-engineering tactics used to steal cryptocurrency and data.