UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack

The Axios npm package was compromised through a highly targeted social-engineering supply-chain attack attributed to UNC1069 (North Korean actors). Attackers cloned a company's identity, used a branded Slack workspace and a fake Microsoft Teams call to trick the maintainer into installing an update that deployed a remote access trojan, enabling theft of npm credentials and publication of two trojanized Axios releases (1.14.1 and 0.30.4) containing WAVESHAPER.V2; associated malware (CosmicDoor and SilentSiphon) was used to exfiltrate credentials and secrets, creating a large-scale risk given Axios's widespread use (~100 million weekly downloads).