Axios npm supply chain attack — North Korean Sapphire Sleet targets 70M weekly downloads
Date: 2026-03
Affected: axios npm package — 70M+ weekly downloads; AI coding agents auto-installing
Attack vector: supply-chain
Category: real-world
Severity: Critical

North Korean state actor Sapphire Sleet compromised the npm account of an axios maintainer, publishing malicious versions with a hidden dependency deploying a cross-platform RAT via post-install hook. Significant because AI coding agents autonomously run npm install. Active ~3 hours.

Impact: Cross-platform RAT deployment; state-sponsored supply chain attack; AI agent amplification risk

Mitigations:
Lock file integrity monitoring
Sandbox npm install operations in AI coding agents
npm provenance verification

Architectural layers (MAESTRO):
label: Agent Ecosystem
notes: NPM maintainer account compromised by state actor
role: origin
label: Deployment & Infrastructure
notes: RAT deployed via post-install hook on developer machines
role: impact