TLDR Tech / InfoSec
Hackers Compromise Axios npm Package to Drop Cross-Platform Malware
Attackers compromised the npm account of the main maintainer of the popular Axios JavaScript package to deploy a malicious version. The malicious version loads a new dependency that runs a post-install script that downloads a payload based on the OS it's running on and eventually downloads a RAT. The compromise does not seem related to the recent TeamPCP attacks, but Google Threat Intelligence Group (GTIG) surmises that the attackers are affiliated with North Korea.
Read the full story