[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbAobwgYi1aCE955G-5ZY0Q6w6PjQpgw-J9afy8gzr8I":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":18,"status":19,"created_at":20,"published_at":21,"article":22,"tags":26,"podcasts":39,"controls":46},"c5ab891b-3021-46a9-8a25-42cc65649446","north-korean-hackers-compromise-axios-npm-package-through-social-engineering","7937f272-75a6-44e5-ab17-ba3ca8621b07","North Korean Hackers Compromise Axios npm Package Through Social Engineering","North Korean threat actors successfully compromised the popular Axios HTTP client by targeting maintainers with sophisticated social engineering attacks disguised as Microsoft Teams error fix messages. The attackers deployed RAT malware to steal npm credentials and published malicious package versions that injected crypto-mining dependencies, affecting millions of users across all major operating systems for three hours. This incident demonstrates how attackers are increasingly targeting package maintainers as high-value assets to compromise entire software supply chains. The coordinated nature of this campaign against multiple Node.js ecosystem maintainers highlights the systematic threat posed to open-source infrastructure.","**Immediate actions:**\n- Audit all npm packages and pin versions to prevent automatic updates to compromised releases\n- Implement multi-factor authentication for all package repository accounts and publishing workflows\n- Verify package integrity using checksums and digital signatures before deployment\n\n**Long-term improvements:**\n- Establish separate, hardened systems for package publishing that are isolated from daily development work\n- Implement mandatory security training for maintainers focusing on social engineering tactics and supply chain threats\n- Deploy automated dependency scanning tools that alert on suspicious package changes or new dependencies\n\n**Detection measures:**\n- Monitor package repositories for unexpected version releases or dependency additions\n- Set up alerts for unusual authentication patterns or login locations for critical maintainer accounts",[12,13,14,15,16,17],"CIS Control 2","CIS Control 11","NIST SP 800-161","NIST SC-30","SLSA Framework","SSDF PW.1",{},"published","2026-04-04T22:07:27.134773+00:00","2026-04-04T22:07:26.961+00:00",{"id":7,"url":23,"slug":24,"title":25},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Faxios-npm-hack-used-fake-teams-error-fix-to-hijack-maintainer-account\u002F","axios-npm-hack-used-fake-teams-error-fix-to-hijack-maintainer-account","Axios npm hack used fake Teams error fix to hijack maintainer account",[27,33],{"id":28,"name":29,"slug":30,"description":31,"color":32},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":34,"name":35,"slug":36,"description":37,"color":38},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[40],{"id":41,"date":42,"edition":43,"title":44,"audio_url":45},"edda011c-96e5-44cd-84a1-4425f5f970d6","2026-04-05","morning","ThreatNoir Weekend Brief — April 5","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-04-05\u002Fthreatnoir-morning-brief-2026-04-05.mp3",[47,51,55],{"slug":48,"name":49,"problem":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":52,"name":53,"problem":54},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":56,"name":57,"problem":58},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]