Cybersecurity — 2026-04-13

North Korea-Linked Group Compromises Axios NPM Package in Major Supply Chain Attack

Google Threat Intelligence Group formally attributed the Axios npm supply chain compromise to UNC1069, a North Korean threat actor, and published detailed technical analysis of the WAVESHAPER.V2 backdoor deployed across Windows, macOS, and Linux. OpenAI confirmed it was impacted but found no evidence of user data access, urging macOS users of ChatGPT, Atlas, and Codex to update immediately with support for older versions ending May 8. Microsoft separately attributed the attack to Sapphire Sleet. This is the first public linking of a major open-source supply chain compromise to Pyongyang state-sponsored cyber operations.

Analysis
Dual attribution from Google (UNC1069) and Microsoft (Sapphire Sleet) converges on Pyongyang, raising confidence substantially. North Korean supply chain targeting of open-source packages is a demonstrated pattern; Lazarus Group has previously compromised npm and PyPI packages for cryptocurrency theft. OpenAI's impact disclosure stands out for specificity (named products, macOS focus, May 8 EOL date) and suggests the blast radius extended further than initial Unit 42 reporting indicated. April 1 coverage addressed the Unit 42 attribution; the Google/Microsoft confirmation and OpenAI disclosure are the material new developments.

2 sources

Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069 - The Hacker News
OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack - SecurityWeek