CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

WAVESHAPER.V2 malware distributed via compromised Axios npm package attributed to UNC1069

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A financially motivated North Korean-aligned threat actor with the moniker UNC1069 compromised the npm account of the maintainer of the Axios library, a widely used HTTP client with approximately 100 million weekly downloads, to publish malicious versions containing the cross-platform WAVESHAPER.V2 malware. The malicious builds were available for only a few hours but were automatically pulled into downstream environments via CI/CD pipelines and dependency chains, exposing enterprises that never directly installed Axios. The malware implements anti-forensic cleanup mechanisms and leverages the build pipeline as the new front line for software supply chain compromise at scale.

Timeline

  1. 06.04.2026 15:46 1 articles · 5h ago

    Axios npm package compromised to distribute WAVESHAPER.V2 malware via UNC1069

    The npm account of Axios’s lead maintainer was compromised by threat actors aligned with UNC1069 to publish malicious versions of the Axios library containing the cross-platform WAVESHAPER.V2 malware. Malicious builds were distributed for a limited duration but were automatically pulled into downstream environments via CI/CD pipelines and dependency chains, exposing enterprises that never directly installed Axios. The malware includes anti-forensic cleanup routines and was designed for scale through software supply chain compromise.

    Show sources
    Open in new tab

Information Snippets