The people in charge of the well-known Axios HTTP client have shared a detailed report about how a developer was tricked by a social engineering scam linked to hackers from North Korea.

This happened after the hackers took over a maintainer’s account to release two harmful versions of Axios (1.14.1 and 0.30.4) on the npm package registry, which led to a supply chain attack.

These releases added a dependency called plain-crypto-js that installed a remote access trojan (RAT) on macOS, Windows, and Linux computers.

The harmful versions were available for about three hours before they were removed. Any systems that installed them during that time should be considered unsafe, and all passwords and security keys should be changed.

The Axios maintainers stated that they have cleaned the affected systems, changed all passwords, and are making changes to prevent similar events from happening again.

Google’s Threat Intelligence Group has since linked this attack to North Korean hackers, known as UNC1069.

“GTIG believes UNC1069, a North Korean hacking group that has been active since at least 2018 and is motivated by money, is behind this activity. This is based on their use of WAVESHAPER.V2, an updated version of WAVESHAPER that they have used before,” Google explains.

“Also, analysis of the tools used in this attack shows similarities to tools used by UNC1069 in past attacks.”

According to a report, the attack started weeks earlier with a targeted social engineering attack on Jason Saayman, the project’s main maintainer.

The attackers pretended to be a real company, copying its branding and the appearance of its founders. They invited the maintainer to a Slack workspace that looked like it belonged to the company. Saayman said the Slack server had realistic channels, with fake activity and profiles that pretended to be employees and other open-source maintainers.

“They then invited me to a real Slack workspace. This workspace was branded to look like the company’s CI and named in a plausible way,” Saayman explained in a post in the report.

“The Slack was very well done. They had channels where they were sharing LinkedIn posts, which I assume just went to the real company’s account, but it was very convincing. They even had what I presume were fake profiles of the company’s team, as well as a number of other open-source maintainers.”

The attackers then scheduled a meeting on Microsoft Teams that seemed to include many people.

During the call, a technical error appeared, saying that something on the system was out of date. The maintainer was asked to install a Teams update to fix the error. However, this fake update was actually RAT malware that gave the hackers remote access to the maintainer’s device, allowing them to steal the npm credentials for the Axios project.

Other maintainers reported similar social engineering attacks, where the hackers tried to get them to install a fake Microsoft Teams SDK update.

This attack is similar to a ClickFix attack, where victims are shown a fake error message and then asked to follow steps that install malware.

This attack also resembles previous campaigns reported by Google’s threat intelligence teams, in which the North Korean hacking group UNC1069 used the same methods to target cryptocurrency companies.

In previous campaigns linked to UNC1069, the hackers would install additional malware on devices, such as backdoors, downloaders, and infostealers, designed to steal passwords, browser data, session tokens, and other sensitive information.

Since the attackers gained access to authenticated sessions, MFA protections were effectively bypassed, allowing access to accounts without needing to log in again.

The Axios maintainers confirmed that the attack did not involve changing the project’s source code. Instead, it relied on adding a malicious dependency to otherwise legitimate releases.

Pelle Wessman, who maintains many open-source projects, including the popular Mocha framework, posted on LinkedIn that he was targeted in the same campaign and shared a screenshot of a fake RTC connection error message used to trick targets into installing malware.

When Wessman refused to install the app, the hackers tried to convince him to run a Curl command.

“When it became clear that I wouldn’t run the app and we had chatted back and forth on their website and chat app, they made one final desperate attempt and tried to get me to run a curl command that would download and run something. When I refused, they disappeared and deleted all conversations,” Wessman explained.

Cybersecurity firm Socket also reported that this was a coordinated campaign that has started targeting maintainers of popular Node.js projects.

Multiple developers, including maintainers of widely used packages and Node.js core contributors, reported receiving similar messages and invitations to Slack workspaces operated by the attackers.

Socket noted that these maintainers are responsible for packages with billions of weekly downloads, showing that the hackers focused on high-impact projects.

“Since we published our initial analysis of the Axios compromise, a deep dive into its hidden impact, and a report on the maintainer confirming it was social engineering, maintainers across the Node.js ecosystem have come forward to report that they were targeted by the same social engineering campaign,” Socket explained.

“The accounts now include some of the most widely used packages in the npm registry and Node.js core itself, and together they confirm that Axios was not a single, isolated target. It was part of a coordinated, scalable attack pattern aimed at high-trust, high-impact open source maintainers.”

Socket said the campaign followed a consistent pattern. The hackers first contacted targets through platforms like LinkedIn or Slack and then invited them to private or semi-private workspaces.

After building rapport with the target, the hackers scheduled video calls, which in some cases were conducted through sites that looked like Microsoft Teams and other platforms.

During these calls, an error message would be displayed to the targets, asking them to install “native” desktop software that works better or run commands to fix the technical issues.

The fact that the same playbook was used against all these targets during the same time period suggests that this was a coordinated campaign rather than a series of isolated attacks.

The Socket researchers say that these types of supply chain attacks are becoming more common. Attackers are now focusing on widely used packages to cause widespread damage.