TLDR Tech / InfoSec
STARDUST CHOLLIMA Likely Compromises Axios npm Package
On March 31, North Korean threat actor STARDUST CHOLLIMA used stolen maintainer credentials to compromise the Axios npm package, introducing a trojanized version containing cross-platform ZshBucket variants targeting various operating systems. This version featured a JSON-based command-and-control (C2) protocol and enabled payload injection and remote execution. Defenders should audit npm credentials and treat Axios installations from this date onward as potentially compromised, given the actor's focus on currency generation and fintech supply chains.
Read the full story