Vulnerability Type: Supply Chain Attack — Compromised npm Package

Severity: High

Affected Systems: npm ecosystem; developer machines; CI/CD pipelines; build environments

Threat Actor: UNC1069 (North Korea-nexus, financially motivated)

Affected Axios Versions:

• [email protected]

• [email protected]

Attack Chain:

• Initial Access: The attacker compromised the npm account belonging to Axios maintainer jasonsaayman, changing the account's registered email to an attacker-controlled address ([email protected]).

  • This allowed unauthorized publication of malicious package versions directly to the npm registry.

  • No vulnerability in npm itself was exploited: The attack relied entirely on abuse of trusted maintainer credentials, with the attacker publishing via direct CLI rather than the project's established GitHub Actions OIDC workflow.

• Weaponization: Malicious versions of Axios (1.14.1, 0.30.4) were uploaded to npm.

  • Both the latest and legacy release channels were poisoned within a 39-minute window.

    • These versions introduced a hidden dependency which served as the malware delivery vehicle: plain-crypto-js (v4.2.1)

    • An earlier version, [email protected], had been published 18 hours prior by the attacker as a clean decoy to build registry history and reduce suspicion.

• Execution: Upon installation of the affected Axios versions via npm install, npm automatically resolves the dependency tree and installs plain-crypto-js, triggering its postinstall lifecycle hook.

  • This executes an obfuscated Node.js dropper script named setup.js (tracked by GTIG as SILKBELL) in the background without requiring any additional user interaction.

    • Execution does not occur at library runtime within an application; it occurs only at install time.

  • The dropper uses a two-layer encoding scheme to conceal its behavior: string reversal followed by Base64 decoding, then an XOR cipher using the key OrDeR_7077 with a position-dependent index.

• Payload Delivery:

  • The dropper detects the target operating system and sends an HTTP POST request to the C2 server at http://sfrclak[.]com:8000/6202033 with a platform-specific request body to retrieve the appropriate second-stage payload.

  • The dropper deploys WAVESHAPER.V2, a cross-platform backdoor with the following platform-specific implementations:

    • macOS: AppleScript downloads a compiled C++ Mach-O binary to /Library/Caches/com.apple.act.mond, disguised as an Apple system daemon, and executes it silently via /bin/zsh.

    • Windows: The legitimate powershell.exe binary is copied to %PROGRAMDATA%\wt.exe, disguised as Windows Terminal. A VBScript wrapper downloads and executes a PowerShell RAT script (%TEMP%\6202033.ps1) with hidden window flags and execution policy bypass.

    • Linux: A Python RAT script is downloaded to /tmp/ld.py and launched via nohup python3 in the background.

• WAVESHAPER.V2 capabilities observed across all platform variants include:

  • Remote command execution

  • File system enumeration

  • Binary payload injection and execution

• Persistence: The malware creates a hidden batch file at %PROGRAMDATA%\system.bat and adds a registry Run key entry named MicrosoftUpdate under HKCU:\Software\Microsoft\Windows\CurrentVersion\Run to re-launch the implant at logon.

  • Observed samples indicate persistence is implemented on Windows, with no persistence mechanisms identified for macOS or Linux variants.

• Command and Control (C2): WAVESHAPER.V2 beacons to http://sfrclak[.]com:8000 every 60 seconds via HTTP POST, transmitting Base64-encoded JSON data.

  • All platform variants use a hardcoded User-Agent string spoofing Internet Explorer 8 on Windows XP: mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0).

    • This string is anomalous on any modern platform and serves as a reliable detection indicator.

  • The backdoor supports four operator commands:

    • kill: Self-terminate

    • runscript: Execute shell commands or scripts

    • peinject: Drop and execute binary payloads

    • rundir: Enumerate directory contents

• Anti-Forensics:

  • Upon successful payload delivery, the dropper self-destructs by deleting setup.js, removing the malicious package.json (which contained the postinstall hook), and replacing it with a clean decoy file named package.md.

  • Post-incident inspection of the node_modules directory shows no trace of malicious code.

• Post-Exploitation:

  • Theft of developer credentials, API keys, and tokens

  • Access to local files, repositories, and project data

  • Potential compromise of CI/CD environments

  • Risk of lateral movement into connected systems