Frequently Asked Questions About the Axios npm Supply Chain Attack by North Korea-Nexus Threat Actor UNC1069

On 2026-03-31 a North Korea–nexus threat actor (attributed by Google to UNC1069) compromised the maintainer account for the widely used axios npm package and published malicious versions 1.14.1 and 0.30.4. Those versions included a malicious dependency named “plain-crypto-js” that delivered WAVESHAPER.V2, a cross‑platform remote access trojan (RAT) targeting macOS, Windows and Linux. The poisoned releases were available on the npm registry for ~three hours and potentially reached millions of developer environments. Tenable and other responders removed the malicious versions and advise treating