UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack
2026-04-03T13:24:11Z•06fbe875e381ecb4f2124d7209770e49bc3ef580204a2dff26b0191301070e9f
UNC1069axioschrome-zero-dayciscocloud-securitycredential-theftcrypto-theftcve-2025-55182cve-2026-20093cve-2026-3502cve-2026-5281defidriftdurable-noncemobile-malwarenextjsnorth-koreanpmreact2shellsocial-engineeringsparkcatsupply-chaintrueconfvertex-aiwhatsapp-phishing','agewheeze','cert-ua','casbaneiro','anthropic
What happened
Multiple high-impact incidents reported: a targeted UNC1069 social‑engineering campaign compromised the Axios npm maintainer and pushed a malicious dependency (plain-crypto-js) in Axios releases (supply‑chain compromise, Google attribution); Solana DEX Drift lost ~$285M via a novel durable‑nonce social‑engineering attack linked to DPRK actors; large-scale credential theft abusing the React2Shell/Next.js flaw (CVE-2025-55182) impacted hundreds of hosts; active zero‑day exploitation of Chrome (CVE-2026-5281) and a TrueConf zero‑day (CVE-2026-3502) were observed; Cisco released patches for a near
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 06fbe875e381ecb4f2124d7209770e49bc3ef580204a2dff26b0191301070e9f
- Enrichment time
- 2026-04-03T13:24:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.