Backdooring of JavaScript Library Axios Tied to North Korea

A supply-chain attack that compromised versions of Axios to distribute a remote access Trojan bears North Korean fingerprints, said security researchers.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

Axios is a widely used JavaScript library for making HTTP requests, which gets downloaded more than 100 million times per week. It’s part of Node Package Manager, or npm, which is the default package manager for the GitHub-maintained JavaScript runtime environment Node.js.

The attack against Axios traces to a “hijacked maintainer account” for the project being used “to publish poisoned Axios releases including 1.14.1 and 0.30.4,” in which “the attacker injected a hidden dependency that drops a cross-platform RAT,” said supply-chain attack prevention platform StepSecurity.

“If you have installed axios@1.14.1 or axios@0.30.4, assume your system is compromised,” said supply-chain security firm Socket.

Threat researchers at Google said the attack occurred Tuesday from 00:21 to 03:20 UTC, and that a threat group with ties to North Korea that it tracks as UNC1069 appears to be the culprit. That’s based in part on the malware involved, which appears to be an updated version of a backdoor it calls WaveShaper, as well as reused command-and-control infrastructure.

The full fallout from the attack is yet to come to light. One risk is that Axios is used in many other software packages. “Since it works both in the browser and on servers (Node.js), a lot of modern JavaScript‑based projects include it as a standard building block,” including web apps, mobile apps, software-as-a-service applications as well as homegrown tools, said Malwarebytes.

“The problem many developers may now have is that whatever they are working in could be interfered with through the RAT – the blast radius of this attack will only become clear over time,” said cybercrime expert Alan Woodward, a visiting professor of computer science at England’s University of Surrey, in a post to social platform X.

“Given the popularity of the compromised package, we expect it will have far-reaching impacts,” said John Hultquist, chief analyst at Google Threat Intelligence Group.

Targeted: Windows, Linux, macOS

Experts described this attack as being stealthy, precise and effective.

“There are zero lines of malicious code inside Axios itself, and that’s exactly what makes this attack so dangerous. Both poisoned releases inject a fake dependency, plain-crypto-js@4.2.1, a package never imported anywhere in the Axios source, whose sole purpose is to run a postinstall script that deploys a cross-platform remote access Trojan,” Socket said.

“The dropper contacts a live command-and-control server, delivers separate second-stage payloads for macOS, Windows and Linux, then erases itself and replaces its own package.json with a clean decoy. A developer who inspects their node_modules folder after the fact will find no indication anything went wrong,” it said.

The choice of target was strategic. “The impact of this attack is broad and has significant ripple effects, as countless other popular packages rely on Axios as a dependency,” said Austin Larsen, principal threat analyst at Google Threat Intelligence Group, in a LinkedIn post.

The hit was precisely executed, and ranks as being “among the most operationally sophisticated supply-chain attacks ever documented against a top-10 npm package,” said StepSecurity.

“The malicious dependency was staged 18 hours in advance. Three payloads were pre-built for three operating systems. Both release branches were poisoned within 39 minutes of each other. Every artifact was designed to self-destruct. Within two seconds of npm install, the malware was already calling home to the attacker’s server before the npm had even finished resolving dependencies,” it said.

Project Maintainer: Socially Engineered

When the attack was unleashed, project maintainers reported temporarily losing control of the project, with one collaborator saying he was locked out.

Axios maintainer Jay Saayman said in a Wednesday GitHub Issue post that the group behind the attack socially engineered him by pretending to be interested in working on the open-source project.

“I am pretty sure they had enough access to hijack from my browser so I believe that is how they got it, i.e. lifting sessions or cookies,” even though he had two-factor authentication enabled, he said. The attackers then appeared to change the email address for his maintainer account, which gave attackers the unrestricted ability to disable TFA and publish new Axios releases.

Google said that UNC1069, also known as CryptoCore, appears to have been active since 2018 and to have ties to the murderous, despotic regime based in Pyongyang.

“This group focuses on cryptocurrency theft, and may be the successor to what was previously tracked as APT38. It often targets cryptocurrency exchanges and financial services firms,” Google reported in 2023.

Repeat Supply-Chain Attacks

This Axios-backdooring campaign doesn’t appear to have any connection to recent supply-chain attacks perpetrated by the hacking group TeamPCP, which it tracks as UNC6780, Google said.

TeamPCP recently pushed two malware-laced versions of the LiteLLM open-source Python library to a central repository. Developers downloaded the malicious repository 47,000 times, despite maintainers removing it less than an hour later. The hackers also recently targeted repositories for Aqua Security’s vulnerability scanner Trivy and Checkmarx’s artificial intelligence-powered application security testing platform.

The hits by TeamPCP appear to have been “a coordinated campaign targeting security tools and open-source developer infrastructure,” and stealing continuous integration and continuous development “secrets and signing credentials, such as GitHub Actions tokens and release signing keys” that will allow attackers to “pivot” to other software projects, said cybersecurity firm Arctic Wolf.

As a result of those campaigns, “at least 1,000 enterprise software-as-a-service environments may be affected,” Arctic Wolf said.

The cumulative, harmful effect of the UNC1069 and TeamPCP supply-chain attacks looks to be serious.

“Hundreds of thousands of stolen secrets could potentially be circulating as a result of these recent attacks. This could enable further software supply-chain attacks, software-as-a-service environment compromises (leading to downstream customer compromises), ransomware and extortion events, and cryptocurrency theft over the near term,” Google said.