How to Detect and Mitigate North Korea-Nexus Supply Chain Attacks on NPM Packages: A Step-by-Step Guide
Introduction
On March 31, 2026, a sophisticated supply chain attack targeted the widely used axios NPM package, compromising versions 1.14.1 and 0.30.4. The attacker, attributed to the North Korea-nexus threat group UNC1069, injected a malicious dependency named plain-crypto-js that delivered the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux. With axios typically averaging over 100 million weekly downloads, the attack posed a massive risk. This step-by-step guide walks defenders through understanding the attack lifecycle, identifying indicators of compromise, and implementing mitigation strategies. Whether you're a developer or security analyst, follow these steps to protect your environment from similar supply chain threats.
What You Need
- Access to package.json files in your projects or repositories.
- NPM audit or Snyk (or similar) for dependency scanning.
- Log analysis tools (e.g., SIEM, Elasticsearch) to review deployment logs.
- Basic JavaScript/Node.js knowledge to understand obfuscation techniques.
- Threat intelligence feeds or access to Google Threat Intelligence Group reports.
- Incident response playbook for credential rotation and system isolation.
Step 1: Understand the Attack Vector – Account Compromise and Email Change
The attack began with the compromise of the legitimate axios maintainer account. Evidence shows the associated email was changed to an attacker-controlled address (ifstap@proton.me) hours before the malicious release. Action: Review contributor accounts for packages you maintain. Ensure all maintainers use multi-factor authentication (MFA) and monitor for unexpected email changes or suspicious activity in package registries. Use NPM's 2FA enforcement for package publishing.
Step 2: Identify Malicious Dependencies in Your Project
The attacker inserted plain-crypto-js version 4.2.1 as a dependency in axios v1.14.1 and v0.30.4. Check your package-lock.json or yarn.lock for any references to
plain-crypto-jsor similar unusual packages. Look for dependencies that have no real project, no GitHub stars, or newly created accounts. Tools like npm audit or Snyk can flag known malicious packages. Runnpm lsto review all installed dependencies and compare against known good versions.Step 3: Inspect package.json for Postinstall Hooks
The malicious dependency's
package.jsoncontained apostinstallscript that executedsetup.jssilently upon installation. Audit all package.json files (including those innode_modules) for suspiciouspostinstall,preinstall, orscriptsentries. Look for encoded or obfuscated commands. In axios's case, the legitimatepackage.jsonwas reverted after execution to hide the trail. Use static analysis tools to detect obfuscated script tags.Step 4: Analyze Obfuscated Droppers – SILKBELL
The
setup.jspayload (SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09) used custom XOR and Base64 obfuscation to hide the C2 URL and OS-specific commands. Decode the script by reversing the XOR key and Base64 layers. Use a sandbox or dynamic analysis to observe execution. Look for the use ofos.platform()and dynamic loading offs,os, andchild_process. The dropper then deletes itself – monitor file system activity for self-deleting scripts.Step 5: Detect OS-Specific Payloads – WAVESHAPER.V2
The dropper delivered WAVESHAPER.V2, a backdoor previously linked to UNC1069. On Windows: Look for execution of
cmd.exeorpowershellwith encoded commands. On macOS/Linux: watch for shell scripts downloading remote executables. Indicators: Check for unusual outbound connections to IPs or domains associated with previous UNC1069 campaigns (cross-reference with threat intel). The backdoor may persist via registry keys or cron jobs.
Source: www.mandiant.com Step 6: Monitor Command-and-Control Communications
The dropper contacts a C2 server (URL hidden in obfuscated code). Set up network monitoring to detect beaconing behavior – periodic SSL/TLS connections to unknown hosts, especially on non-standard ports. Extract the C2 domain/ip from the decoded script and add it to your blocklist. Use DNS logs to identify queries to suspicious domains.
Step 7: Remediate – Remove Malicious Packages and Rotate Credentials
If you find evidence of compromised axios versions in your environment: Immediately remove those package versions from
package-lock.jsonand force reinstall withnpm clean-installafter rolling back to a trusted version. Rotate any API keys, tokens, or secrets that may have been exposed on compromised machines. Isolate affected systems and run full antivirus scans. Report the incident to your security team and to NPM.Step 8: Implement Preventive Measures
- Enable 2FA on all package maintainer accounts.
- Use package pinning – specify exact versions in
package.jsonand verify integrity via SHA hashes in lock files. - Deploy Software Composition Analysis (SCA) tools to continuously monitor dependencies.
- Audit postinstall scripts in dependencies using automated checks (e.g.,
npm lockdown). - Maintain up-to-date threat intelligence feeds to catch emerging indicators.
Tips for Ongoing Protection
Stay proactive, not reactive. Supply chain attacks are becoming more sophisticated, especially from state-nexus actors like UNC1069. Regularly review the NPM advisory database and Google Threat Intelligence reports. Consider using private registries or mirroring trusted packages. Educate your team on social engineering tactics that target maintainers. Remember: the attacker changed the email address – watch for account takeover symptoms. Finally, maintain immutable backups and an incident response playbook tailored to software supply chain incidents.