North Korean hackers implicated in major supply chain attack

Google researchers have attributed a compromise of Axios, a JavaScript library downloaded roughly 100 million times weekly, to North Korean hackers linked to the group UNC1069. Attackers gained access to a maintainer account and published at least two malicious versions of the package targeting macOS, Windows, and Linux systems before the code was removed within three hours. The malware was designed to steal credentials and grant attackers persistent access to infected systems, posing particular risk given Axios's presence in approximately 80% of cloud and code environments. Google warned the incident could have "far-reaching impacts," and Wiz has already observed the malicious versions in roughly 3% of scanned environments. Security researchers are still investigating how the attackers initially breached the maintainer's GitHub account.