Every week, the Axios npm package is downloaded over 50 million times. It is one of the most trusted, most widely used JavaScript libraries in the world — used in React applications, Node.js backends, and countless commercial products that billions of people use daily. This week, Google’s Threat Intelligence Group confirmed that a North Korean threat actor called UNC1069 successfully tampered with Axios’s update mechanism, distributing malicious code to an unknown number of those millions of weekly downloads. When you ran npm install axios, you trusted it completely. So did everyone else. That trust is exactly what supply chain attackers exploit — and understanding how they do it is one of the most important skills in modern security.
- What Is a Supply Chain Attack?
- What Actually Happened to Axios — The Technical Breakdown
- Who Is UNC1069 — North Korea’s Financially Motivated Hackers
- 5 Methods Attackers Use to Poison npm Packages
- Dependency Confusion — The $130,000 Bug Bounty Attack Explained
- How to Detect and Prevent Supply Chain Attacks — Professional Methodology
- Check Your Project Right Now — Hands-On Audit
- Supply Chain Security as a Career Path
What Is a Supply Chain Attack?
Think about the food you buy at a supermarket. You trust that the apple is safe because it came from a trusted farm, was processed at a licensed facility, and was inspected before reaching the shelf. You do not personally check every apple for contamination — you trust the supply chain. If someone wanted to poison a lot of people efficiently, the most effective approach would not be to tamper with individual apples on supermarket shelves. It would be to compromise the factory that processes millions of apples at once — before they reach any shelf.
A software supply chain attack works exactly like this. Instead of attacking the final application, attackers compromise a component that many applications depend on — a library, a build tool, a code repository, an update server. A single successful compromise spreads to every product and every user that depends on that component. The SolarWinds attack reached 18,000 organisations through one compromised software update. The XZ Utils backdoor came within days of affecting every Linux server on the internet. The Axios npm compromise reached millions of JavaScript developers in a single operation.
The reason supply chain attacks are so devastating is the same reason they are so hard to defend against: trust. The same trust mechanism underlies the Cisco Salesforce and AWS breach by ShinyHunters reported this week — organisations trusted their cloud vendor integrations implicitly, without testing whether that trust was warranted. Different layer of the stack, identical psychological exploit. We trust our dependencies because they have been reliable, well-reviewed, and widely adopted. That accumulated trust is exactly the target.
Open source software is maintained by volunteers, often unpaid, who receive pull requests and dependency updates from contributors they have never met. The review process varies wildly. Some critical infrastructure packages are maintained by a single person working in their spare time. This is not a criticism of open source — it is an observation about the attack surface. Sophisticated state actors can invest months contributing legitimate code to build trust, then slip a malicious change past maintainers who are reviewing dozens of PRs. The XZ Utils backdoor was planted over two years of patient, trust-building contributions.
What Actually Happened to Axios — The Technical Breakdown
Axios is a JavaScript HTTP client library used by developers to make network requests in both browser-based applications and Node.js backends. At over 50 million weekly downloads, it is one of the ten most downloaded packages in the entire npm ecosystem. It is used by Fortune 500 companies, startups, government applications, and millions of personal projects.
According to Google’s Threat Intelligence Group, UNC1069 exploited a vulnerability in the CVE-2026-3502 — specifically a flaw in how Axios’s updater validation mechanism worked. When the Axios library checked for updates, it fetched update code from a remote server. The integrity of that update code was supposed to be verified before execution. The flaw was that this integrity check was insufficiently validated — allowing an attacker who had compromised or could influence the on-premises or update server to substitute a tampered update package.
In plain English: Axios has a mechanism that allows it to check for and apply updates. The code that does this checking was not verifying the update’s authenticity strongly enough. UNC1069 exploited this to slip malicious code into the update flow — so that developers who updated Axios during the compromise window received the real Axios library plus hidden additional code controlled by the attackers.
1. Package fetches update from registry 2. Registry returns: update code + cryptographic signature 3. Package verifies signature using known-good public key 4. IF signature valid → apply update 5. IF signature invalid → REJECT, warn user, log alert ↑ Attacker cannot forge signature without private key
1. Package fetches update from registry 2. Registry returns: update code + cryptographic signature 3. Package checks: does signature field EXIST? Yes → proceed (Does NOT verify signature CONTENT against expected key) 4. Apply update — even if signature is forged or empty 5. Attacker who controls update server can substitute ANY code ↑ Presence of any signature field bypasses check entirely
Step 1: In any project directory that has a package.json, check your Axios version:
npm list axios
Step 2: Run a full dependency audit:
npm audit
Step 3: Check your package-lock.json integrity hashes are present:
cat package-lock.json | grep -A3 '"axios"'
Look for the “integrity” field — it should contain a sha512 hash. This hash is verified against the package on download. If it is missing or empty, your project has no integrity verification.
No JavaScript project? Use Python’s equivalent: pip-audit — or check any project with npm audit on a fresh npm init -y && npm install axios.
Who Is UNC1069 — Understanding the Threat Actor Behind This Attack
UNC1069 is a threat actor cluster tracked by Google’s Threat Intelligence Group (GTIG) with suspected North Korean attribution. The designation “UNC” stands for “Uncategorised” — a cluster of activity that shares characteristics and infrastructure with known North Korean groups but has not yet been formally merged with a named group like APT38 or Lazarus.
North Korean state-sponsored hackers are distinctive in the threat landscape for one specific reason: their attacks are explicitly designed to generate money for the North Korean regime. Where Chinese state hackers primarily pursue espionage, and Russian groups often mix espionage with disruption, North Korean groups are assigned revenue targets. They steal cryptocurrency, conduct financial fraud, and compromise organisations to sell access or extort them. This is why they repeatedly target supply chains — a compromised popular library gives them access to cryptocurrency developers, financial application backends, and enterprise systems at massive scale in one operation.
5 Methods Attackers Use to Poison npm Packages — Know All of Them
The Axios compromise is one of five well-documented methods for poisoning open source packages. Understanding all five is essential — because they require different defences, and because ethical hackers test for each of them when assessing an organisation’s supply chain security posture.
What happens: Attacker steals or phishes the npm account credentials of a trusted package maintainer. Publishes a new version with malicious code under the legitimate maintainer’s identity.
How to detect: Monitor for unexpected new versions of critical packages, especially if changelog is empty or brief. Use tools like socket.dev which analyses package behaviour changes between versions.
Real example: Multiple npm packages compromised this way including event-stream (2018) and ua-parser-js (2021).
What happens: Attacker compromises the build or update pipeline of a legitimate package. Malicious code is injected into the package during the build process — the source code repository remains clean but the distributed binary is tainted.
How to detect: Verify that package contents match published source code. Use reproducible builds where the build output is deterministic and can be independently verified.
Defence: SLSA (Supply chain Levels for Software Artifacts) framework provides attestations that prove a package was built from a specific source via a trusted process.
What happens: Attacker registers a package with a name almost identical to a popular one. axois instead of axios. Developers who mistype install the malicious version.
How to detect: Use lockfiles and automated checks that alert on new packages being added to a project. npm’s built-in typosquatting detection catches some common variations.
Real examples: Hundreds of typosquatted packages found monthly on npm — cross-env, jest, babel, webpack all have active typosquats targeting them.
What happens: Attacker discovers a private internal package name used by a company. Registers a public version of that name with a higher version number. npm fetches the public malicious version instead of the intended private one.
How to detect: Use scoped packages (@company/package-name) for all internal packages. Configure npm to use your private registry for all scoped packages.
Bug bounty: Researcher Alex Birsan earned $130,000 demonstrating this against Microsoft, Apple, PayPal, Shopify and others in 2021.
What happens: Your application uses Package A. Package A depends on Package B. Attacker compromises Package B — a package you have never heard of and never explicitly installed. Your application is now compromised via a dependency you did not know existed.
How to detect: Use SCA tools that analyse your entire dependency tree, not just direct dependencies. npm audit checks transitive dependencies. Snyk and OWASP Dependency-Check go deeper with license analysis and known-bad package detection.
Scale: A typical React application has 1,000+ transitive dependencies. Most developers know fewer than 20 of them by name.
npm install requst instead of npm install request. The package installs successfully and the app appears to work. Which supply chain attack method does this most likely represent?Dependency Confusion — The $130,000 Bug Bounty Attack That Shook the Industry
In 2021, security researcher Alex Birsan published one of the most significant supply chain security findings in history. He discovered that if a company uses private npm packages with non-scoped names (like company-internal-auth rather than @company/internal-auth), he could register a public package with the same name at a higher version number. npm, when resolving dependencies, defaults to the highest available version — and it checks public registries before private ones in many configurations.
The result: a developer at a company who ran npm install company-internal-auth might receive Birsan’s public package (version 9.9.9) rather than the real internal package (version 1.0.0), because npm saw the higher version number and fetched it from the public registry. Birsan included a harmless proof-of-concept payload that reported back which company’s machine it ran on. He earned over $130,000 from bug bounty submissions to Microsoft, Apple, PayPal, Shopify, Netflix, Yelp, Tesla, and dozens of others — all from the same technique.
# Company's internal package.json { "dependencies": { "company-auth": "1.0.0" } } # Attacker registers public: "company-auth": "9.9.9" (higher!) # npm fetches public 9.9.9 instead # of private 1.0.0. Malware runs.
# Use scoped packages for ALL internal { "dependencies": { "@company/auth": "1.0.0" } } # Configure npm scope to private registry: # "@company:registry=https://npm.company.com" # Scoped packages only resolve from # company registry. Public cannot interfere.
# Step 1: Find company's internal package names # (from GitHub repos, job postings, npm error messages) # Step 2: Check if name exists on public npm npm view company-internal-package-name # If "Not Found" → potential target # Step 3: Register public package at high version # Include harmless PoC payload (callback to your server) # Wait for company dev machines to install it # Step 4: Report to company with proof of install # = $5,000 to $30,000 per company depending on impact
Step 1: Open your project’s package.json. Look at the “dependencies” section.
Step 2: Identify any packages that look like internal names — company names, project code names, internal tool names. Any package that is NOT scoped with @ is a potential target.
Step 3: For each suspected internal package, check if it exists publicly:
npm view PACKAGE-NAME version 2>/dev/null || echo "NOT on public npm"
Step 4: Check if your project has a .npmrc file that configures private registry routing:
cat .npmrc
# Should contain lines like:
# @company:registry=https://your-private-registry.com
What a vulnerable finding looks like: Internal-looking package name + not on public npm + no .npmrc scope routing = active dependency confusion vulnerability.
How to Detect and Prevent Supply Chain Attacks — The Professional Security Methodology
Supply chain security has its own discipline — Software Composition Analysis (SCA). It is worth noting that supply chain attacks are evolving beyond code packages: AI training data poisoning is a supply chain attack at the model layer — corrupt the data a model trains on and you compromise every application that deploys it, at scale. The OWASP LLM Top 10 lists this as a primary threat class. — and its own frameworks. The professionals who specialise in this area work at the intersection of development and security, building the defences that companies like Google, GitHub, and npm itself use to catch attacks like the Axios compromise. Here is the full defensive stack.
# npm built-in — checks against npm advisory database npm audit --audit-level=high # Snyk — deeper analysis including license and behaviour checks snyk test # OWASP Dependency-Check — cross-ecosystem CVE matching dependency-check --project "MyApp" --scan ./node_modules
# Always commit package-lock.json — it contains integrity hashes # In CI, use ci instead of install — enforces lockfile npm ci # Fails if package-lock.json is out of sync with package.json # Verify a specific package's published integrity: npm view axios dist.integrity # Compare against your lockfile — any mismatch = tampering
# Socket.dev — analyses package behaviour changes between versions # Flags: new network calls, new file system access, new env var reads npx socket npm install axios # Before installing, Socket shows: what changed in this version # If new version suddenly reads process.env.AWS_SECRET_KEY → RED FLAG # TruffleHog (from Article 2) also scans npm packages for secrets trufflehog npm --package [email protected]
# SBOM = Software Bill of Materials # An inventory of every component in your software # Like a food ingredients label — for code npx @cyclonedx/cyclonedx-npm --output-format JSON > sbom.json # When new CVE drops: search SBOM for affected package # "Are we using axios? Which version? Which products?" # Without SBOM: hours of searching. With SBOM: seconds.
process.env.AWS_SECRET_ACCESS_KEY. What should you do?Check Your Project Right Now — The Complete Dependency Security Audit
npm install axios@latest npm list axios # Verify you are on the clean version
npm audit pip-audit # Python equivalent bundle audit # Ruby equivalent
cat package-lock.json | python3 -c "
import json,sys
lock=json.load(sys.stdin)
pkgs=lock.get('packages',{})
missing=[k for k,v in pkgs.items() if 'integrity' not in v and k]
print('MISSING INTEGRITY:',missing[:10] if missing else 'None - good!')"trufflehog filesystem ./node_modules --only-verified # Looks for accidentally included secrets in your dependencies
# .github/workflows/security.yml - name: Audit dependencies run: npm audit --audit-level=high - name: Use lockfile (no version ranges) run: npm ci # not npm install
Step 1: In any Node.js project:
npm install -g @cyclonedx/cyclonedx-npm
cyclonedx-npm --output-format JSON > sbom.json
Step 2: Open sbom.json and look at the “components” array. Count how many dependencies you have. Most developers are shocked — a typical React app has 800-1,500 dependencies.
Step 3: Search the SBOM for Axios:
cat sbom.json | python3 -c "import json,sys; s=json.load(sys.stdin); [print(c['name'],c.get('version','?')) for c in s.get('components',[]) if 'axios' in c['name'].lower()]"
What this gives you: When the next supply chain compromise is announced, you search your SBOM instead of manually checking every project. This is the difference between a 3-hour incident response and a 3-minute one.
Supply Chain Security as a Career Path — One of the Fastest-Growing Specialisations in 2026
Supply chain security is where development meets security — and the professionals who can work fluently in both are in extremely high demand. DevSecOps engineers, Application Security (AppSec) engineers, and supply chain security analysts are roles that companies are hiring for urgently, paying well, and struggling to fill.
The skills you learned today — SCA tooling, SBOM generation, dependency confusion testing, package integrity verification — are directly billable in penetration testing engagements, bug bounty programmes, and security engineering roles. Alex Birsan earned $130,000 in bug bounties from dependency confusion alone. Supply chain findings on major programmes regularly pay $10,000–$50,000.
as the supply chain it came from.
Learn to audit, secure, and test software supply chains. Start with the ethical hacking fundamentals and build to the advanced supply chain techniques used by Google, GitHub, and every major security firm.
Frequently Asked Questions – NPM Supply Chain Attack
SecurityElites — 25 Types of Malware Hackers Use in Real Attacks — the full malware taxonomy — supply chain attacks deliver many of these categories simultaneously
SecurityElites — Ethical Hacking Tools List 2026 — SCA tools, dependency scanners and the full supply chain security toolkit used by professionals
SecurityElites — Cybersecurity Career Roadmap 2026 — how DevSecOps and supply chain security fit into the full career progression
OWASP Dependency-Check — free open source SCA tool for identifying known vulnerable dependencies →
SLSA Framework — Supply Chain Levels for Software Artifacts — Google’s open framework for supply chain integrity and build provenance →
I have sat in incident response calls where the first 90 minutes were spent just trying to figure out which applications used the compromised package — because nobody had an SBOM. The frantic spreadsheet work, the Slack messages, the pull requests being audited manually one by one. The organisations that got through it in 10 minutes were the ones who had invested lot in security. Understanding how attacks actually work is the only way to build defences that actually stop them.
