STARDUST CHOLLIMA Likely Compromises Axios npm Package
2026-04-03T19:23:38Z•af72a736d194c94181199f760250b02b443205bed48ba56ae8fd24648bcdb10b
AI-securityAxiosCNAME-abuseCNAPPCVE-2026-20929FalconKerberosSIEMSTARDUST CHOLLIMAauthentication-relaydata-securitydetectionincident-responsemalicious-packagenodejsnpmproduct-releasesupply-chainthreat-intelligencevulnerability-management
What happened
CrowdStrike published multiple posts including a high-risk supply-chain finding—researchers believe the STARDUST CHOLLIMA actor likely compromised the popular Axios npm package, creating a downstream supply‑chain risk to Node.js projects and their consumers. The feed also highlights a detection writeup for CVE-2026-20929 (Kerberos authentication relay via DNS CNAME abuse), plus several product and feature announcements (Falcon secure boot certificate lifecycle, CNAPP advancements, Falcon Data Security, SIEM integrations, and AI/agentic security topics). Immediate priorities: treat Axios-based/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- crowdstrike_blog
- Record identifier
- af72a736d194c94181199f760250b02b443205bed48ba56ae8fd24648bcdb10b
- Enrichment time
- 2026-04-03T19:23:38Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.