North Korea Hid 1,700 Malicious Packages Inside Your Dev Team's Tools

The packages were published under GitHub aliases including golangorg, aokisasakidev, and aokisasakidev1, with supporting persona networks under maxcointech1010 and maxcointech0000. They impersonated common developer utilities — debug loggers, license validators, HTTP libraries — names chosen because they sound like the kind of thing a developer installs without a second thought.

Socket reported all identified live packages to the affected registries and submitted takedown requests for associated GitHub accounts. The crates.io security team removed logtrace under advisory RUSTSEC-2026-0081. The Go Security team blocked the identified malicious modules. The npm security team removed the aokisasakidev packages. At time of reporting, some packages had been removed. Others remained live.

The Contagious Interview cross-ecosystem cluster is only one part of a broader offensive. A separate, even more consequential operation targeted Axios — the most popular JavaScript HTTP client library in the world, with approximately 100 million weekly downloads and present in an estimated 80% of cloud environments.

This attack was not a fake package. It was a compromised legitimate one. UNC1069 ran a multi-week social engineering campaign targeting Jason Saayman, the lead maintainer of Axios. They built rapport across messaging platforms, masqueraded as credible contacts, and eventually delivered a remote access trojan that gave them persistent access to his development environment — and the long-lived npm access token that Axios used for publishing.

The Axios maintainer described the campaign as 'extremely well coordinated, looked legit, and was done in a professional manner.' Any engineer who maintains open-source packages with high download counts is a priority target.

The second-stage payload deployed across both the ecosystem packages and the Axios compromise is WAVESHAPER.V2 — a cross-platform RAT with variants for Windows (PowerShell), macOS (native C++ Mach-O binary), and Linux (Python). It is a direct evolution of WAVESHAPER, a backdoor previously attributed exclusively to UNC1069 and historically deployed against the cryptocurrency sector.

Once installed, WAVESHAPER.V2 beacons to its C2 server every 60 seconds using Base64-encoded JSON. The hardcoded user-agent spoofs Internet Explorer 8 on Windows XP — a trivially detectable anomaly on any modern network and an immediate flag in EDR telemetry on macOS and Linux hosts.

WAVESHAPER.V2 supports four commands: kill (terminate the process), rundir (enumerate directory listings), runscript (execute AppleScript, PowerShell, or shell commands), and peinject (execute arbitrary binaries in memory). Target data: cloud credentials, SSH keys, AWS secrets, Kubernetes tokens, and cryptocurrency wallet files.

The operation is attributed with high confidence to UNC1069, a financially motivated North Korea-nexus threat actor that Google's Mandiant unit has tracked since at least 2018. The group overlaps with several other tracked aliases across different vendor naming conventions, all describing the same cluster of activity: Sapphire Sleet, BlueNoroff, Stardust Chollima, Alluring Pisces, CageyChameleon, CryptoCore, MASAN, and GhostCall.

UNC1069's defining characteristic, per Microsoft, is operating multi-week, low-pressure social engineering campaigns across Telegram, LinkedIn, and Slack — either impersonating known contacts or credible brands, or by leveraging access to previously compromised accounts — before delivering a fraudulent Zoom or Microsoft Teams meeting link.

The Security Alliance (SEAL) blocked 164 UNC1069-linked domains impersonating Microsoft Teams and Zoom services between February 6 and April 7, 2026 alone.

Supply chain attacks against developer tooling work because of a fundamental assumption baked into modern software delivery: that packages from trusted registries can be installed automatically without manual review. CI/CD pipelines pull dependencies, resolve version ranges, and run install hooks without pausing to ask whether the code being fetched is safe.

The postinstall hook is particularly significant. npm, PyPI, and other package managers support hooks that execute arbitrary code when a package is installed — before the developer ever imports or runs the package's advertised functionality. In the Axios attack, the malicious payload executed via plain-crypto-js's postinstall hook the moment npm install ran. The developer never saw a prompt, never ran the malicious code explicitly, and in many cases never knew the package was installed at all — because it was a transitive dependency two levels deep.

What made the Axios attack possible was a compound vulnerability in the trust model. The Axios project used OIDC Trusted Publishing, which is the correct modern approach. But the GitHub Actions workflow still had a long-lived NPM_TOKEN environment variable present. npm defaults to the token if present, allowing the attacker — who had stolen that token via the maintainer's compromised workstation — to bypass the OIDC provenance mechanism entirely.

Eight immediate actions for your security and engineering teams:

The combination of the Contagious Interview ecosystem packages and the Axios maintainer compromise tells a coherent strategic story. The typosquatting campaign requires a developer to make a mistake — installing the wrong package. The maintainer compromise required no developer mistake at all. It required only that Axios had 100 million weekly downloads, that its maintainer was reachable on Telegram and LinkedIn, and that a long-lived npm token existed as a fallback.

North Korea has built a factory-model capability for poisoning open-source supply chains at scale — 1,700 packages across five ecosystems, with shared infrastructure, identical loader logic, and now confirmed access to a library present in 80% of cloud environments. The capability is fully operational.

The correct response is not to treat this as an npm problem or a Python problem or a Go problem. It is a trust model problem that runs through every package registry where automated CI/CD systems install dependencies without human review. The attack surface is every software project that has ever run npm install, pip install, go get, cargo add, or composer require — and resolved a version range automatically.

Any environment that ran npm install between March 31, 00:21 and 03:20 UTC and resolved to axios@1.14.1 or axios@0.30.4 should be treated as fully compromised regardless of whether active C2 communication was observed. The malware self-deletes after execution. Absence of artifacts does not mean absence of compromise.