UNC1069 Social Engineering Attack Compromises Axios npm Package, Threatens JavaScript Ecosystem
The Axios npm package maintainer, Jason Saayman, confirmed a supply chain compromise due to a sophisticated social engineering attack by North Korean threat actors known as UNC1069. The attackers impersonated a legitimate company's founder, inviting Saayman to a fake Slack workspace and a Microsoft Teams meeting. During the meeting, a fake error message prompted an update that deployed a remote access trojan, allowing the attackers to steal npm account credentials. This led to the publication of two trojanized Axios package versions containing the WAVESHAPER.V2 implant. The attack shares similarities with tactics used by UNC1069 and BlueNoroff, previously targeting crypto founders and public figures. Saayman has since implemented preventive measures, including resetting devices and credentials and updating GitHub Actions. 
