A significant cybersecurity incident has emerged involving a widely used JavaScript library, Axios, which has been compromised by a suspected North Korean hacker. This attack, identified by security firms including StepSecurity and Aikido, targeted developers who rely on Axios for internet connectivity in their software, raising concerns for millions of users.
The malicious versions of Axios were uploaded to npm, a repository for open source projects, and were available for download for approximately three hours before the attack was mitigated. The frequency of downloads for Axios, estimated in the tens of millions weekly, raises the potential impact of the breach. Users who may have downloaded the altered library are advised to assume their systems could be compromised.
Google's Threat Intelligence Group has linked the breach to a group of hackers it tracks as UNC1069, emphasizing the group's extensive experience with supply chain attacks. This incident is part of a worrying trend where hackers target popular open source projects, as seen in previous attacks on companies like 3CX and Kaseya.