North Korean hackers linked to Axios npm supply chain compromise
2026-04-01T14:51:50Z•b61bd00b99d40dc1a59528f1beee292221a0a2587a46c88aa058248e5f028f8c
CVE-2026-5281UNC1069agent-detectionai-governanceai-securityaxiosbackdoorchatgptchromecis-benchmarkscopilotcryptocurrencydeepfakesemail-securitygoogle-geminiidentity-fraudmicrosoft-365north-koreanpmpost-install-scriptquantum-risksoftware-supply-chainuse-after-freewebgpuzero-day
What happened
Multiple security developments: a software supply‑chain compromise of the popular Axios npm packages has been attributed to financially motivated North Korean actors (linked to UNC1069); attackers published two backdoored Axios releases by hijacking a maintainer’s npm account and adding a hidden dependency with a post‑install script that executes on install. Google patched 21 Chrome vulnerabilities including an in‑the‑wild zero‑day (CVE‑2026‑5281), a use‑after‑free in Dawn/WebGPU. Other industry news: Exabeam expanded Agent Behavior Analytics to detect AI agent threats across ChatGPT, Copilot,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- b61bd00b99d40dc1a59528f1beee292221a0a2587a46c88aa058248e5f028f8c
- Enrichment time
- 2026-04-01T14:51:50Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.