--- title: North Korean Hackers Breach Popular Axios NPM Package in Supply Chain Attack description: North Korean hackers breach Axios library, compromising 3% of users with malware targeting multiple systems. canonical_url: https://codekeeper.co/ticker/north-korean-hackers-compromise-axios-library --- # North Korean Hackers Breach Popular Axios NPM Package in Supply Chain Attack North Korean hackers breach Axios library, compromising 3% of users with malware targeting multiple systems. ![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png) By Content Team Apr 1, 2026 Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ON THIS PAGE ### Want more insights like this? Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox. By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) . North Korean hackers compromised the widely-used Axios JavaScript library on March 31, 2026, publishing two malicious versions that were downloaded by roughly 3% of users before being removed three hours later. The attackers hijacked the NPM account of Axios maintainer @jasonsaayman and inserted a backdoor dependency called plain-crypto-js that deployed cross-platform malware capable of remote shell access and system reconnaissance. With over 100 million weekly downloads, Axios is present in about 80% of cloud environments, making this breach particularly significant. The malware targeted Windows, macOS, and Linux systems and was designed to erase its tracks to avoid detection. Google attributed the attack to UNC1069, a North Korean group known for targeting cryptocurrency and DeFi platforms since 2018. Organizations that installed the compromised versions should treat their systems as breached and immediately audit dependencies, rotate credentials, and scan for malware. **Source:** [SecurityWeek](https://www.securityweek.com/axios-npm-package-breached-in-north-korean-supply-chain-attack/) Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fnorth-korean-hackers-compromise-axios-library%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg) ![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp) Have questions about protecting your software? Our escrow experts are standing by to help. [Book a free demo](https://codekeeper.co/book-a-demo) YOU MAY ALSO LIKE [Ransomware Gang Teams Up With Supply Chain Hackers in "Industrialized" Attack Model Aug 12, 2026](https://codekeeper.co/ticker/sophos-warns-of-vect-teampcp-cyber-threat) [Cyberattacks Hackers Targeted French Supermarket Fridges, Spoiling Millions in Food Oct 14, 2026](https://codekeeper.co/ticker/cyberattack-on-french-supermarkets-refrigeration) [Metabase Zero-Day Flaw Lets Attackers Seize Admin Access Without Logging In Aug 11, 2026](https://codekeeper.co/ticker/metabase-zero-day-sql-injection-flaw) [![FBI arrests Canadian in Pennsylvania linked to ShinyHunters hack, part of efforts to dismantle the group after breaching FBI data.](https://codekeeper.co/hubfs/_sized/Generated%20Blog%20Post%20Images/fbi-arrests-canadian-in-shinyhunters-hack-800.png) Cyberattacks New Arrest in the Hunt for the FBI Jobs Site Hackers Oct 12, 2026](https://codekeeper.co/ticker/fbi-arrests-canadian-in-shinyhunters-hack)