Apps & Consumer
Axios library hijacked by North Korean hackers to spread malware
A suspected North Korean hacker hijacked the popular Axios library to distribute malware, which could put millions of developers at risk before the attack was stopped.
On Monday, a hacker pushed malicious versions of Axios, a widely used open-source JavaScript library that developers rely on to connect their software to the internet. The compromised library was hosted on npm, a software repository for open-source projects. Axios is downloaded tens of millions of times every week, meaning the incident threatened to expose a vast network of downstream users. According to the security firm StepSecurity, which analyzed the attack, the hijack was spotted and stopped in around three hours overnight from Monday into Tuesday. While the immediate threat was halted quickly, the breach highlights the vulnerability of foundational development tools.
The attacker executed the supply chain attack—a term for attacks targeting software to compromise users who download it—by compromising the account of a primary developer authorized to push updates. The hacker replaced the legitimate developer’s email address on the account with their own, making it more difficult for the developer to regain access. Once in control of the account, the hacker inserted malicious code designed to deliver a remote access trojan (RAT), which is malware providing remote control of a computer. The hacker then pushed these malicious versions of Axios in an update for Windows, macOS, and Linux users. Following the incident, the security company Aikido, which investigated the compromise, warned that anyone who downloaded the code should assume their system is compromised.
Google has attributed the Axios compromise to North Korean hackers. Specifically, Google’s Threat Intelligence Group linked the attack to UNC1069, which it tracks as a suspected North Korean threat actor. John Hultquist, the chief analyst for Google’s Threat Intelligence Group, noted that North Korean hackers have deep experience with supply chain attacks, which they have historically used to steal cryptocurrency. In a statement, Hultquist said: “North Korean hackers have deep experience with supply chain attacks, which they’ve historically used to steal cryptocurrency. The full breadth of this incident is still unclear, but given the popularity of the compromised package, we expect it will have far reaching impacts.”
Why it matters
The hijack of a widely used open source library like Axios demonstrates the significant risk of supply chain attacks, where compromising a single piece of foundational software can expose vast numbers of downstream devices.