2026-03-31 · 2026-Q1
Axios npm Supply Chain Attack
Outside the model: Adjacent ecosystem Agent tooling was not the attack surface, so no layer applies.
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- Yes
Target
Axios (70-100M weekly npm downloads)
Impact
Malicious versions tagged "latest" delivered cross-platform RAT via dependency "plain-crypto-js"
Root Cause
Social engineering of lead maintainer's npm credentials by Sapphire Sleet / UNC1069 (DPRK)