Axios npm Maintainer Account Hijacked to Push Self-Cleaning RAT
The Axios npm package, a widely used JavaScript HTTP client, was compromised via social engineering of its maintainer by North Korean threat actors UNC1069. The attackers published two malicious versions (1.14.1 and 0.30.4) that added a fabricated dependency, plain-crypto-js@4.2.1, which runs a postinstall script without user interaction. This script downloads a platform-specific remote access trojan (RAT) for macOS, Windows, or Linux from actor-controlled infrastructure and then deletes itself and restores a clean package.json to erase local forensic traces.
Detection cannot rely on local node_modules inspection because the dropper removes itself after execution. Instead, defenders must analyze npm registry publication logs and monitor network traffic for connections to the C2 server at 142.11.206.73. The attack exposes supply chains to stealthy RAT deployment through trusted package updates, requiring rollback to safe Axios versions and credential rotation for affected environments.