North Korean Hackers Compromise Axios Maintainer

Suspected North Korean hackers compromised a lead maintainer of the popular JavaScript library Axios on March 31, 2026, publishing two malicious versions to the npm registry that installed remote access trojans on developers' machines across Windows, macOS, and Linux systems.

The attack, attributed to the threat group UNC1069 by Google Threat Intelligence, began approximately two weeks earlier through a sophisticated social engineering campaign targeting Jason Saayman, Axios's primary maintainer. According to Saayman's postmortem published on GitHub, the hackers impersonated the founder of a legitimate company, cloning its branding, website, and profiles to build credibility. They invited Saayman to a convincing fake Slack workspace featuring active channels, shared LinkedIn posts, and fabricated employee accounts, including profiles mimicking other open-source maintainers. After establishing rapport, the attackers scheduled a Microsoft Teams meeting. During the call, a fabricated error message prompted Saayman to install what appeared to be a necessary update, which instead delivered the RAT malware granting the hackers remote access to his computer.