The security breach involving the axios package on npm is a significant concern for developers and organizations relying on this popular HTTP client library. Here's a summary of the key points from Google Threat Intelligence Group (GTIG) regarding this incident:
Overview
- Threat Actor: UNC1069, a North Korea-nexus threat actor.
- Attack Vector: Supply chain attack through npm package
axios. - Compromised Versions:
Impact and Scope
- The compromised versions were pushed to the official npm registry, affecting a wide range of projects that depend on these specific versions.
- Hundreds of thousands of secrets could be at risk due to this supply chain attack.
Technical Details
- C2 Infrastructure:
sfrclak[.]com(IP: 142.11.206.73) - Malware Variant: WAVESHAPER.V2, a macOS and Linux backdoor.
- Persistence Mechanism:
- On Windows, persistence is achieved by creating a hidden batch file (
%PROGRAMDATA%\system.bat) and adding an
- On Windows, persistence is achieved by creating a hidden batch file (
Read the full article at Threat Intelligence
Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.
4
Contents
Ali NematiWritten by Ali
