STARDUST CHOLLIMA Likely Compromises Axios npm Package
2026-04-02T07:23:36Z•6c79ad47f0dbf75887fec849c8a1103659d2cf314c136f9ff83af4a5614be55e
AI-securityCNAME-abuseCNAPPCVE-2026-20929Falcon-Data-SecurityFalcon-FlexKerberosSTARDUST_CHOLLIMAagentic-SOCaxioscertificate-lifecycledetection-guidancenext-gen-SIEMnpmrisk-prioritizationsecure-bootsoftware-supply-chainsupply-chain-compromisethird-party-EDR
What happened
CrowdStrike published a set of April 2026 blog posts highlighting a likely software supply‑chain compromise (STARDUST CHOLLIMA reportedly likely compromised the popular Axios npm package), detection guidance for a notable Kerberos relay vulnerability (CVE-2026-20929) leveraging DNS CNAME abuse, and multiple product and platform updates — including Windows Secure Boot certificate lifecycle management, Falcon Data Security, CNAPP adversary‑informed risk prioritization, Falcon Next‑Gen SIEM third‑party EDR support, and agentic/AI agent security offerings. The feed emphasizes supply‑chain risk and
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- crowdstrike_blog
- Record identifier
- 6c79ad47f0dbf75887fec849c8a1103659d2cf314c136f9ff83af4a5614be55e
- Enrichment time
- 2026-04-02T07:23:36Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.