Hackers Behind Massive Axios NPM Attack Linked to Notorious BlueNoroff Group

Security researchers at Kaspersky have uncovered technical evidence linking the massive supply chain attack on the popular JavaScript library Axios to BlueNoroff, a state-sponsored cybercrime unit affiliated with North Korea’s notorious Lazarus Group.

The revelation, presented at the Kaspersky APAC Cyber Security Weekend 2026 in Guangzhou, sheds light on one of the most widespread open-source supply chain compromises of the year.

Over 100 Million Downloads at Risk

Axios is a staple of modern web development, averaging over 100 million weekly downloads on the npm registry. In March 2026, attackers compromised the account of a lead Axios maintainer and published malicious updates to the package.

Instead of altering the main code directly, the hijacked packages introduced a hidden dependency named plain-crypto-js. Executed automatically during installation via a postinstall script, the dependency dropped a cross-platform Remote Access Trojan (RAT) designed to infect Windows, macOS, and Linux systems alike.

The BlueNoroff Connection

While attributing cyberattacks is notoriously difficult, Kaspersky’s Global Research and Analysis Team (GReAT) identified distinct technical fingerprints linking the Axios incident to previous BlueNoroff operations—specifically two high-profile campaigns known as GhostCall and GhostHire.

According to Sergey Lozhkin, Kaspersky’s Head of GReAT for APAC and META, researchers uncovered several shared technical signatures:

• Shared Artifacts: Matching user-agent strings and a distinctive module string labeled webT.
• Updated Malware: The deployment of a new variant of the SyphonV2 loader.
• Cross-Platform Delivery: A single infrastructure setup configured to target Linux, macOS, and Windows simultaneously.

“These similarities provide indicators of a possible connection to BlueNoroff, although technical overlaps alone do not constitute definitive attribution,” cautioned Lozhkin. “Threat actors can reuse malware components and infrastructure, or deliberately adopt characteristics from other campaigns to obscure their identity.”

Targeting the Crypto Ecosystem

BlueNoroff is widely recognized as a financially motivated threat actor targeting financial institutions, Web3 projects, and cryptocurrency platforms across India, Australia, Turkey, and parts of Europe and Asia.

While its previous campaigns relied on social engineering—such as fake job offers (GhostHire) or masquerading as executives (GhostCall)—poisoning a core developer tool like Axios marks a significant escalation in reach, giving attackers a potential backdoor into thousands of enterprise and crypto development environments worldwide.

How Developers and Teams Can Protect Themselves

Kaspersky advises software development teams and organizations using open-source packages to strengthen their supply chain security:

• Treat Accounts with Caution: Assume even trusted developer or maintainer accounts can be compromised. Verify unexpected package updates or script changes through secondary channels.
• Audit Automated Scripts: Avoid running unverified postinstall or build scripts without prior code review.
• Deploy Endpoint Detection: Use modern EDR/XDR platforms alongside Threat Intelligence feeds to flag unauthorized cross-platform loaders and hidden outbound connections in real time.