Feross on TBPN: How North Korea Hijacked Axios

Key Takeaways

• North Korean state actors successfully compromised the lead maintainer of the Axios npm package.
• The attackers utilized a sophisticated, multi-week social engineering campaign involving a fake company, a fake Slack workspace, and a staged Microsoft Teams call.
• Malware was delivered to the maintainer disguised as a software update, leading to the compromise of their machine.
• The compromise granted the threat actors publish access to the npm registry for the Axios package.
• The incident highlights the systemic vulnerability of 'blind trust' in the open-source software supply chain.

Affected Systems

• npm package registry
• Developer workstations

Attack Chain

North Korean threat actors initiated contact with the lead Axios maintainer, building trust over several weeks. They established a deceptive infrastructure, including a fake company, a fake Slack workspace, and a staged Microsoft Teams call. During these interactions, the attackers convinced the maintainer to download and execute a file disguised as a software update. This malware compromised the developer's machine, allowing the attackers to hijack their session or credentials and gain publish access to the Axios package on npm.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No specific detection rules or queries are provided in the article.

Detection Engineering Assessment

EDR Visibility: Medium — EDR on the developer's machine could detect the execution of the disguised software update and subsequent post-exploitation activity, but the initial social engineering occurs off-sensor. Network Visibility: Low — Traffic to fake Slack workspaces or Teams calls appears as legitimate SaaS traffic, making network-based detection of the social engineering phase highly difficult. Detection Difficulty: Hard — The attack relies heavily on out-of-band social engineering and exploiting human trust, bypassing traditional technical controls until the final payload execution phase.

Required Log Sources

• EDR process execution logs
• Authentication logs (npm registry)
• Web proxy logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for unusual execution of software updates or installers originating from untrusted or newly observed domains associated with communication platforms.	EDR process and network events	Execution	Medium
Monitor for unexpected or anomalous authentication events to package registries (like npm) from developer workstations, especially following unusual communication patterns or from unexpected IP addresses.	Authentication logs	Credential Access/Impact	Low

Control Gaps

• Lack of strict verification for third-party communications and job offers
• Insufficient endpoint protection against socially engineered payloads on developer machines

Key Behavioral Indicators

• Execution of unverified binaries downloaded during communication sessions
• Anomalous npm publish events or session token usage

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Review and audit npm publish access logs for anomalous activity.
• Enforce mandatory Multi-Factor Authentication (MFA) for all package maintainers and critical infrastructure access.

Infrastructure Hardening

• Implement strict endpoint controls on developer workstations, including application allowlisting and restricted administrative privileges.
• Utilize hardware security keys (e.g., YubiKeys) for accessing code repositories and package registries.

User Protection

• Deploy advanced EDR solutions on all developer endpoints to detect anomalous execution of downloaded files.

Security Awareness

• Train developers on advanced social engineering tactics, specifically targeting open-source maintainers via fake job offers, interviews, or collaborations.
• Establish strict verification protocols for external communications and software downloads during third-party engagements.

MITRE ATT&CK Mapping

• T1566 - Phishing
• T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools
• T1204.002 - User Execution: Malicious File
• T1078 - Valid Accounts