/
/ 

The package supply chain as an attack surface: axios, PolinRider, and the developer machine

2026-08-01 · Web3 Security On 31 March 2026 two versions of axios, a library downloaded 101 million times in the preceding week, shipped a dependency that installed a remote access trojan on Windows, macOS and Linux. Every incident in this article works the same way: somebody…

01 / 01 Sections Sections

2026-08-01 · Web3 Security

On 31 March 2026 two versions of axios, a library downloaded 101 million times in the preceding week, shipped a dependency that installed a remote access trojan on Windows, macOS and Linux. Every incident in this article works the same way: somebody else’s credential, somebody else’s build step, and a wallet key sitting on the machine that ran it.

The incidents

Campaign Date Reach What it took Status
Ledger Connect Kit 2023-12-14 Loader pulled at runtime by DApps; @ledgerhq/connect-kit-loader at 148,496 weekly downloads Signed transactions rerouted by Angel Drainer Fixed in 1.1.8; malicious code live approx. 5 hours
@solana/web3.js 2024-12-03 482,365 weekly downloads Private key material from apps handling keys directly Unpublished; CVE-2024-54134; patched in 1.95.8
typo-crypto 2025-03 19 weekly downloads Second-stage payload by OS 4.3.0 still live on npm, checked 2026-08-01
faster_log, async_println 2025-05-25 8,424 downloads over four months Ethereum and Solana private keys found in log files Deleted from crates.io 2025-09-24
debug, chalk + 16 2025-09-08 18 packages, over two billion weekly downloads combined (Sygnia) Browser wallet transactions rewritten before signing Removed; approx. $500 taken (Sygnia)
PolinRider 2025-12-07 onward 121 unique packages, 196 artifacts (Socket, 1 Aug 2026) Loader delivering DEV#POPPER and OmniStealer Active
axios 2026-03-31 101,032,032 downloads the prior week (npm) Cross-platform RAT via plain-crypto-js@4.2.1 Removed after 2h 54m; CISA alert 2026-04-20
npm publishing wave 2026-03-20 to 04-20 108 package names, 261 version nodes (Panther) Wallet keys, Telegram sessions, SSH keys, .npmrc Ongoing

Case file

Field Value
Matter Open-source package registries as a delivery channel for crypto-stealing malware
Court None. No prosecution has been brought publicly in any incident here
Registries npm, Packagist, Go module proxy, crates.io, Chrome Web Store, VS Code Marketplace
Government record CISA Alert, 20 April 2026; CVE-2024-54134; CVE-2026-34841
Advisory record MAL-2023-8697, MAL-2024-11183, MAL-2025-46969, MAL-2025-46974, MAL-2026-2306, MAL-2026-2307, MAL-2026-3400
Attribution, axios cluster Sapphire Sleet, per Microsoft Threat Intelligence and Amazon Threat Intelligence
Attribution, npm wave Famous Chollima / DeceptiveDevelopment, per Panther Threat Research, high confidence
Attribution, PolinRider Contagious Interview / Famous Chollima, per Socket and OpenSourceMalware
Attribution, wallet figures Expel-TA-0001 / HexagonalRodent, per Expel, assessed as a subgroup of Famous Chollima
Largest single reach axios, 101,032,032 downloads in the week before compromise, per npm’s own registry API
Posture as of 1 August 2026 No charges. PolinRider active. Socket’s counter still moving
Firms cited here Panther, Expel, Socket, OpenSourceMalware, Microsoft, Amazon, Wiz, Sygnia

What the record shows

What happened to axios

Jason Saayman, the lead maintainer of axios, published a post-mortem as issue 10636 in the project’s own repository on 2 April 2026. It records that on 31 March 2026 two malicious versions of axios, 1.14.1 and 0.30.4, were published to npm through his compromised account, and that both injected a dependency called plain-crypto-js@4.2.1 that installed a remote access trojan on macOS, Windows and Linux.

The post-mortem gives the sequence for the package itself. About two weeks before 31 March, a social engineering campaign was initiated against the lead maintainer. On 30 March at 05:57 UTC, plain-crypto-js@4.2.0 was published to npm. On 31 March at 00:21 UTC, axios@1.14.1 was published with plain-crypto-js@4.2.1 injected. Around 01:00 UTC, axios@0.30.4 was published with the same payload, the first external detections landed, and community members filed issues reporting the compromise, which the attacker deleted using the compromised account. At 01:38 UTC the axios collaborator DigitalBrainJS opened pull request 10591 to deprecate the compromised versions, flagged the deleted issues to the community, and contacted npm directly. The malicious versions were removed at 03:15 UTC and plain-crypto-js at 03:29 UTC.

The window between publication and removal was two hours and fifty-four minutes. Saayman’s own summary rounds it to “about 3 hours”. On the root cause, the post-mortem states: “The attacker gained access to the lead maintainer’s PC through a targeted social engineering campaign and RAT malware. This gave them access to the npm account credentials, which they used to publish the malicious versions.” Under lessons learned it records that “there was no automated way to detect an unauthorized publish. Detection depended entirely on the community noticing.”

The two advisory records bracket the takedown. The Open Source Vulnerabilities database carries MAL-2026-2306 for plain-crypto-js, published 31 March 2026 at 02:07:58 UTC, listing versions 4.2.0 and 4.2.1. MAL-2026-2307 for axios, and the corresponding GitHub Security Advisory GHSA-fw8c-xr5c-95f9, were both published at 03:15:49 UTC, listing 0.30.4 and 1.14.1. The advisory on the injected dependency was therefore public roughly an hour before npm pulled the packages.

What the malicious dependency actually did

Microsoft Threat Intelligence and the Microsoft Defender Security Research Team published an analysis on 1 April 2026. It describes the mechanism as dependency insertion rather than code modification: “The trusted package’s application logic is not modified; instead, the threat actor added a dependency that is never imported by the package’s runtime code but only exists to trigger an install-time script to download the second-stage RAT.”

Microsoft’s account of the staging is that plain-crypto-js@4.2.0 was published clean “to establish publishing history and reduce scrutiny”, and 4.2.1 added the install hook running node setup.js. The two axios releases were then published with what Microsoft calls “a surgical manifest-only change”, adding plain-crypto-js@^4.2.1 as a dependency while leaving the axios source unchanged. Microsoft notes that the publication metadata for the malicious versions differed from the project’s normal CI-backed publishing pattern, missing trusted publisher binding and the corresponding repository tag and commit trail.

On execution, Microsoft records that the loader decoded strings at runtime, identified the platform, and connected to hxxp://sfrclak[.]com:8000/6202033, with the operating system conveyed in the POST body and a platform-specific payload returned from the single route. On macOS the payload was a native binary written to /Library/Caches/com.apple.act.mond. On Windows it was a PowerShell script, 6202033.ps1. The associated IP address, 142.11.206.73, is tied to a virtual private server provider Microsoft says the actor commonly uses. Microsoft attributes both the infrastructure and the axios compromise to Sapphire Sleet, which it describes as a North Korean state actor.

Microsoft also flags a persistence detail that changes the remediation: users “should also follow the mitigation and protection guidance provided in this blog, including disabling auto-updates for Axios npm packages, since the malicious payload includes a hook that will continue to attempt to update.”

What CISA published

The Cybersecurity and Infrastructure Security Agency released an alert on 20 April 2026 titled “Supply Chain Compromise Impacts Axios Node Package Manager”. Its factual paragraph reads: “On March 31, 2026, two npm packages for versions axios@1.14.1 and axios@0.30.4 of Axios npm injected the malicious dependency plain-crypto-js@4.2.1 that downloads multi-stage payloads from cyber threat actor infrastructure, including a remote access trojan.” The alert cites the maintainer’s post-mortem and the Microsoft analysis as its two sources.

CISA’s remediation list is the operational core of the document: monitor repositories, pipelines and developer machines that ran npm install or npm update with the compromised version; pin dependency versions to known safe releases; downgrade to axios@1.14.0 or axios@0.30.3 and delete node_modules/plain-crypto-js/; rotate version control tokens, CI/CD secrets, cloud keys, npm tokens and SSH keys, and for ephemeral CI jobs rotate all secrets injected into the compromised run; block and monitor outbound connections to the C2 domain.

CISA then recommends four standing controls for organisations using axios: phishing-resistant multifactor authentication on all developer accounts, ignore-scripts=true in .npmrc, which “prevents potentially malicious scripts from executing during npm install packages”, and min-release-age=7 in .npmrc, which restricts installs “to only install packages that have been published for at least seven days”. The fourth is behavioural: establish a baseline of normal execution for tools that use axios and alert when a dependency behaves differently.

The reach figure, and the three numbers for it

Reported reach for axios varies by source. Microsoft describes axios as having “over 70 million weekly downloads”. Amazon describes it as “one of the most widely used JavaScript libraries with more than 100 million weekly downloads”. npm’s own registry API, queried directly, returns 101,032,032 downloads for axios in the week of 24 to 30 March 2026, the seven days ending the day before the compromise, and 18,057,508 on 31 March itself. The registry figure is the primary and is the one used here.

The 31-day npm publishing wave

Panther Threat Research published a report on 24 April 2026, written by Michael Baker, titled “Inside DPRK’s npm malware factory: 108 packages, 261 versions, and a 31-day campaign wave”. Its opening states that “over approximately 30 days, Panther Threat Research monitored, clustered, and tracked a DPRK-linked npm malware campaign spanning 108 malicious packages and a total of 261 package versions.” The window is given as 2026-03-20 to 2026-04-20, with the campaign averaging more than three new package names per day.

Panther distinguishes the two counts where most repetition of them does not. Its methodology note reads: “We use 108 malicious package names for the reconciled campaign set and 261 observed package-version nodes for the broader rendered campaign graph shown here.” The 261 is a node count on a graph, not a count of versions of the 108.

On what the packages were built to take, Panther lists: “crypto wallets and key material, cloud provider credentials, SSH private keys, browser credentials and cookies, Telegram Desktop sessions, .npmrc credentials, local .env files, as well Solana key material related to Polymarket.” Multiple clusters wrote attacker-controlled SSH keys into authorized_keys. One cluster used blockchain transaction data as a dead-drop channel for resolving the second stage. Panther records that two C2 IP addresses associated with high-value clusters had never been submitted to VirusTotal at the time of its snapshot.

Panther’s attribution: “Our attribution confidence is high: this campaign is consistent with DPRK’s Famous Chollima / DeceptiveDevelopment activity”, based on BeaverTail-consistent behaviour and keying patterns, OtterCookie-consistent delivery and C2 characteristics, and infrastructure overlap with previously documented DeceptiveDevelopment npm activity.

Where the 26,584 figure comes from, and what it is attached to

The figures of 26,584 wallets and 2,726 machines come from Expel, in research published on 22 April 2026 by Marcus Hutchins, titled “Inside Lazarus: How North Korea uses AI to industrialize attacks on developers”. The sentence is: “From victim IP addresses and system hostnames contained within the data, we are able to deduce that the threat actor’s campaigns exfiltrated a total of 26,584 cryptocurrency wallets from 2,726 infected developer’s systems.”

Four things about that sentence matter and are lost every time the number is repeated.

The provenance is an exposed database, not telemetry. Expel writes that “at one point during the course of our investigation, a misconfiguration exposed the workflow tracker’s backend database, allowing us to obtain the raw data from it.” Expel assesses the panel to be a workforce tracker for team leaders rather than a command-and-control server, and reads 31 unique campaign IDs across 6 teams out of it.

The actor is not the actor in the npm wave. Expel names it Expel-TA-0001, alias HexagonalRodent, and assesses with medium-high confidence that it is a subset of Famous Chollima. Expel separates it explicitly from the group behind the axios compromise: “Groups like Stardust Chollima (AKA Sapphire Sleet), and Pressure Chollima (AKA JadeSleet / TraderTraitor) conduct sophisticated, highly targeted intrusions into the networks of large crypto exchanges. HexagonalRodent, in comparison, is much more opportunistic.”

The vector is not primarily package publishing. Expel describes HexagonalRodent’s method as fake job offers followed by backdoored take-home coding assessments, using the tasks.jsonrunOn: "folderOpen" feature in VS Code. Under the heading “A rare supply chain attack”, Expel writes: “Recently, HexagonalRodent appears to have successfully pulled off a supply chain attack. This is not something we’ve seen from this group before”, referring to the fast-draft VS Code extension revealed on 18 March 2026.

No date range is attached to the pair. Expel’s $12 million figure is windowed, to 1 January through 31 March 2026. The 26,584 / 2,726 sentence carries no period at all; it says “the threat actor’s campaigns”.

What the $12 million is, and is not

Expel’s wording is precise and the coverage of it is not. Expel: “In total, it appears that public keys for wallets holding a total of up to $12 million dollars worth of crypto assets were exfiltrated from victim systems in the first 3 months of 2026.” The summary line at the top of the report reads “though hardware security tokens may limit damage”.

Expel then states what it could not establish: “While we did attempt to evaluate the total value of assets successfully stolen, this task proved essentially impossible.” Because the workforce tracker holds no private keys, Expel cannot confirm which wallets yielded full unencrypted private keys, and records that “the data lists many of the wallets as being protected by hardware tokens, which means that even with persistent access to the owner’s system, the threat actors would be unlikely able to drain those wallets.” The confirmed tracing is thin by comparison: funds from at least 13 of the wallets reached a known DPRK-operated Ethereum address, itself created in 2023 and holding over $1.1 million from all sources.

The Record, from Recorded Future News, headlined its coverage “North Korean hackers siphon more than $12 million from crypto users in sprawling campaign”. Expel’s own claim is public keys for wallets holding up to that amount. The gap between those two statements is the difference between an upper bound on what was in view and a figure for what was taken.

PolinRider

Socket’s Threat Research Team published on 1 July 2026, written by Karlo Zanki. Its finding: “162 malicious release artifacts identified across 108 unique packages, including compromise traces in 80 Go modules, 10 Packagist packages, and one Chrome extension.” Socket links the activity to “the broader North Korean Contagious Interview / Famous Chollima developer-targeting campaign”.

The sub-counts do not reconcile to 108 in any published breakdown. The Hacker News, reporting on the same Socket research on 4 July 2026, gives the split as “19 npm libraries, 10 Composer packages, 61 Go modules, and one Google Chrome extension”, which totals 91. Socket’s own text says 80 Go modules, which would total 110. OpenSourceMalware reconciles the two Go figures on 8 July 2026: “more than 80 Go modules (roughly 61 of them confirmed as distinct malicious module versions)”. Neither reading arrives at 108.

The 108 is also a snapshot of a live counter. Socket’s campaign tracking page for PolinRider, read on 1 August 2026, gives first discovery as 2025-12-07, last activity as 2026-07-28, and 196 affected package artifacts across 121 unique packages. That page lists the ecosystems as actions, composer, chrome and npm.

On technique, Socket records that the actors “plant obfuscated JavaScript loaders in legitimate repositories, conceal the code through whitespace padding or fake .woff2 font files, and trigger execution through developer tooling such as VS Code task files”, using Git history rewriting with force pushes and anti-dated commits. Socket’s defensive conclusion follows from that: “This makes the GitHub landing page and visible commit history unreliable indicators of compromise; defenders should review repository activity logs, package release metadata, VS Code task configuration, and suspicious changes to configuration files.” Once deobfuscated, the loader reaches TRON, Aptos and BNB Smart Chain services for encrypted second-stage material, decrypts it with embedded XOR keys, and executes it with eval(). Observed payloads are DEV#POPPER and OmniStealer.

OpenSourceMalware, which named the campaign, explains why it crossed registries without changing. Go module identity is a repository path and a version is a git tag, so “if you can push a tag to the repo, you have published a Go module version.” Packagist stores metadata pointing at the GitHub repository and Composer downloads a zipball of the tagged commit straight from GitHub. In both cases repository access and publishing access are the same capability. OpenSourceMalware records the consequence for npm and PyPI, where they differ: maintainers of npm packages were hit on GitHub, but “as far as we can tell none of the malicious force pushes made their way into the NPM registry”, and on the seized Xpos587 account the actor had full write access to Python repositories and produced no malicious PyPI release.

PolinRider’s attribution, and the two-groups claim

OpenSourceMalware’s dossier, dated 2026-03-07 and last updated 2026-04-11, states: “The OpenSourceMalware team has attributed this campaign to the DPRK, and the threat actor PolinRider is a known Lazarus group contributor with connections to ‘Contagious Interview’ and ‘TasksJacker’ campaigns.” Its April update goes further in the other direction: “PolinRider and TasksJacker have operationally merged. We now have direct evidence that the same threat actor is running both the config-file injection and the .vscode/tasks.json curl-to-shell infection vector against the same victim population.” OpenSourceMalware consolidated the two clusters under one tag.

So the published position from both naming researchers is one actor spanning two previously separate clusters, inside the Contagious Interview / Famous Chollima family. A claim that PolinRider involves two distinct DPRK groups, specifically Lazarus Group and APT37, appears in aggregator coverage and traces to no primary this desk could find. It is not used here.

The scale figures for the GitHub half of the campaign are OpenSourceMalware’s own count: 675 compromised repositories across 352 owners on 8 March 2026, rising to 1,951 repositories across 1,047 owners by 11 April 2026. The dossier also documents two weaponised take-home assessment projects, ShoeVista and StakingGame, which is the point at which this campaign and the fake-recruiter playbook are the same operation.

The earlier record

Ledger Connect Kit, 14 December 2023. Ledger published a security incident report dated 20 December 2023. Its timeline records that on the morning of 14 December “a former Ledger Employee fell victim to a sophisticated phishing attack that gained access to their NPMJS account, bypassing 2FA, using the individual’s session token”, and that malicious versions 1.1.5, 1.1.6 and 1.1.7 were published at 09:49, 10:44 and 11:37 CET. Ledger was alerted at 13:45 and deployed a genuine version within 40 minutes.

The root cause is stated without hedging: “The access of the former employee to Ledger’s systems (including Github, SSO based services, all internal Ledger tools, and external tools) were properly revoked, but unfortunately the former employees’ access to NPMJS was not properly revoked.” Ledger’s report also explains why one npm publish reached every DApp at once. Connect Kit is loaded at runtime from a CDN by a separate loader component, “which allows DApp developers to always have the most recent version of the Connect-Kit without the need to manually update package versions and release new builds”, and the CDN Ledger used for distribution was npm itself. The payload was Angel Drainer, which Ledger describes as “a malware as a service that is specifically designed to craft malicious transactions that are draining signers, also known as hardware wallets, when signed”, with on-chain evidence of an 85/15 split between exploiter and drainer operator. Ledger puts total elapsed time at approximately five hours from compromise to resolution, with active draining “confined to less than two hours in total”. MAL-2023-8697 records the malicious package.

npm’s registry API shows @ledgerhq/connect-kit itself at 16 downloads for the week of 7 to 13 December 2023, and the loader, @ledgerhq/connect-kit-loader, at 148,496. The install count of the compromised package is not the reach of the compromise.

@solana/web3.js, 3 December 2024. The advisory published by the library’s own maintainers, GHSA-jcxm-7wvp-g6p5, later issued as CVE-2024-54134, states that “a publish-access account was compromised for @solana/web3.js“, allowing the attacker to publish modified packages “allowing them to steal private key material and drain funds from dapps, like bots, that handle private keys directly.” The affected window is given as 15:20 to 20:25 UTC on 3 December 2024, the unauthorised versions as 1.95.6 and 1.95.7, and the fix as 1.95.8. The advisory is explicit about who was not exposed: “This issue should not affect non-custodial wallets, as they generally do not expose private keys during transactions. This is not an issue with the Solana protocol itself, but with a specific JavaScript client library.” Weekly downloads in the week before were 482,365.

faster_log and async_println, crates.io. The Rust Project published an incident report on 24 September 2025. Both crates were published on 25 May 2025 and downloaded 7,181 and 1,243 times respectively. The malicious code ran at runtime rather than build time, during a log packing operation, searching processed files for “Quoted Ethereum private keys (0x + 64 hex), Solana-style Base58 secrets, Bracketed byte arrays” and exfiltrating matches to a Cloudflare Workers subdomain styled as a Solana RPC endpoint. The crates.io team deleted them at 15:34 UTC on 24 September 2025 and records that they “had no dependent downstream crates on crates.io”. The report credits Kirill Boychenko of Socket’s Threat Research Team with the report.

debug, chalk and 16 others, 8 September 2025.MAL-2025-46974 records debug@4.4.2 and MAL-2025-46969 records chalk@5.6.1, both published to the advisory database on 8 September 2025. Sygnia’s report puts the scale and the speed together: “Within approximately 16 minutes of gaining account access, attackers injected malicious code into at least 18 trusted JavaScript packages which, collectively, are downloaded over two billion times per week.” Sygnia describes browser-side interception across Ethereum, Bitcoin, Solana, TRON, Litecoin and Bitcoin Cash, with the malware altering “wallet addresses or transaction parameters during execution, redirecting funds while leaving user interfaces unchanged”. Wiz Research measured the propagation: 99% of cloud environments held at least one targeted package beforehand, and after release the malicious code itself “could be found in at least 10% of cloud environments”, within a two-hour availability window. Sygnia’s figure for what the campaign actually took is approximately $500 in cryptocurrency. npm’s registry gives debug at 357,603,707 and chalk at 299,998,281 weekly downloads for the week before.

typo-crypto, March 2025. Amazon Threat Intelligence identified this one working backwards from the axios investigation, and reported it to the OSV database, where it is MAL-2026-3400, published 8 May 2026. Amazon’s account: “That investigation uncovered that the same DPRK-linked threat actor had committed a trojanized file to the typo-crypto NPM package in March 2025. The malicious file, core.js, masquerades as the legitimate core-js NPM package within the typo-crypto repository.” Amazon assesses the campaign as “small scale and likely served as a testing ground for the more visible supply chain operations that followed in late 2025 and 2026”. npm’s registry shows 19 downloads in the week to 8 May 2026.

typo-crypto is the one artefact from this record that a reader can still walk up to. Queried on 1 August 2026, registry.npmjs.org/typo-crypto returns a single published version, 4.3.0, tagged latest. The two packages from the axios compromise return the opposite result on the same query: axios carries 143 versions with 1.19.0 as latest and neither 1.14.1 nor 0.30.4 among them, and plain-crypto-js carries one version, 0.0.1-security.0, which is the placeholder npm publishes over a name it has taken down.

Who is doing this, per whom

Amazon Threat Intelligence published on 29 July 2026, under the byline of chief information security officer CJ Moses, the connection that had not been made publicly before: “the compromises of the axios, debug, chalk, and typo-crypto libraries were carried out by the same DPRK-linked threat actor tracked by the security community as SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces.” The basis is stated: “Amazon Threat Intelligence identified shared tactics, techniques, and procedures (TTPs) across these supply-chain campaigns, including trojanized NPM packages, use of post-install hooks (scripts that run automatically when a package is installed), and code reuse.” The confidence level is medium, and Amazon says so.

Amazon also states the common entry point across all four: “In each case, the threat actor gained access by socially engineering a trusted maintainer of the package, then published a software update containing malicious code. Any organization that automatically pulled the latest version of these packages received the compromised update.”

That gives four named clusters across the record in this article, tracked by four different firms. Sapphire Sleet for axios, debug, chalk and typo-crypto, per Microsoft and Amazon. Famous Chollima / DeceptiveDevelopment for the March-April 2026 npm publishing wave, per Panther. Contagious Interview / Famous Chollima for PolinRider, per Socket and OpenSourceMalware. Expel-TA-0001 / HexagonalRodent for the wallet figures, per Expel, assessed as a subset of Famous Chollima. No court has tested any of it and nobody has been charged.

What I think is going on

Start with the thing that took me longest to establish and matters most.

I was handed this subject as a single sustained campaign: 108 malicious packages, 261 versions, 26,584 wallets from 2,726 developer machines. Every one of those numbers is real and each of them comes from a different report about a different thing. The 108 and 261 are Panther’s, from a 31-day npm publishing wave. The 26,584 and 2,726 are Expel’s, from a leaked workforce-tracker database belonging to a group whose main delivery vehicle is a fake job interview, and Expel says in the same report that a supply chain attack was a first for them. There is a second, separate 108 attached to PolinRider by Socket, and that one has since moved to 121. Four numbers, three firms, and a chain of coverage that welded them into one sentence because they were published within a month of each other and all say North Korea.

That is not a pedantic complaint. If you believe those figures describe one campaign, you conclude that npm packages exfiltrated 26,584 wallets and you go and audit your dependency tree. What Expel’s data actually says is that a developer accepted a coding assessment and opened it in VS Code. Different problem, different fix, and the fix for the second one is not in your lockfile.

Now the thing everyone gets right and then draws the wrong lesson from. The blast radius on axios was enormous and the yield was probably close to nothing. One hundred and one million downloads a week, three hours live, and the payload was a generic remote access trojan. Look at the one case where somebody measured a comparable event: eighteen packages, two billion weekly downloads between them, a purpose-built browser-side wallet address rewriter, one in ten cloud environments reached inside two hours, and Sygnia’s number for what came out of it is about $500. The distribution is the most impressive thing in this asset class and the conversion is terrible.

Here is why, and it is the whole reason the second half of this article exists. A build tool is a bad place to put a drainer. Most of the machines that install chalk are CI runners, and a CI runner has no wallet. The high-yield target is the individual developer’s laptop, and the reliable way to reach that laptop is to talk to the human sitting at it. That is what HexagonalRodent does, at a rate of 2,726 machines. A package registry shows up in its operation occasionally. The fake job offer is the road.

So I read the March 2026 npm activity as two DPRK operations that happen to share a registry. Sapphire Sleet went after one enormous package by grooming one maintainer for two weeks. Famous Chollima published three new package names a day for a month under throwaway accounts. Those are different theories of the same problem and both were running in the same fortnight. Panther’s window opens on 20 March, axios lands on 31 March inside it, and the attribution splits anyway. Anyone treating “malicious npm packages, spring 2026” as one story is going to misread both.

The most useful sentence in any of this research is one that got no headlines. Expel: “The data lists many of the wallets as being protected by hardware tokens, which means that even with persistent access to the owner’s system, the threat actors would be unlikely able to drain those wallets.” Read that again with the situation in mind. The attacker owns the machine. Full remote access, credentials, browser cookies, SSH keys, shell history. And the wallets behind a hardware device are still a problem for them. That is a control performing exactly as advertised under the worst realistic conditions, and the observation comes out of the attacker’s own database.

On the maintainer side, the pattern across every incident here is that the credential was easier than the code. Ledger’s own report says a departed employee’s npm access was never revoked while every internal system was. axios’s maintainer was worked on for two weeks before anything was published. chalk’s maintainer was phished on a lookalike domain and eighteen packages were poisoned within sixteen minutes. Amazon’s summary of all four cases is one sentence long and it is about social engineering. Nobody found a bug in a package. They found the person who can publish it.

The version range is the part I would change first if I could change one thing in this industry. Writing ^1.14.0 in a manifest is a standing instruction to install whatever that maintainer’s account publishes next, forever, on every machine that ever builds the project. Microsoft’s remediation note makes the point sharper than I can: the axios payload “includes a hook that will continue to attempt to update”, so the auto-update behaviour is both how you got infected and how you stay infected. Then look at the timings. Two hours fifty-four minutes for axios. Two hours for chalk and debug. CISA’s answer to all of it is one line in a config file, min-release-age=7, which says do not install anything published in the last seven days. Almost every incident on this page would have missed almost everybody who set it. I am not going to say it prevents this class of attack, because a patient actor waits eight days. It closes the specific window that every one of these campaigns actually used.

Two more structural things worth saying plainly.

Go and Packagist do not have a publishing credential. OpenSourceMalware’s explanation of this is the clearest technical writing I read all week: in Go, “if you can push a tag to the repo, you have published a Go module version”, and Packagist reads the repo through a webhook. So for those ecosystems, a compromised GitHub account is a compromised registry, with no second factor to fail at. That is the entire reason PolinRider crossed into three new ecosystems without any change to the malware. And it explains the asymmetry in the same campaign, where npm and PyPI held because the actor had the repository and not the upload token.

And git history is not evidence. PolinRider force-pushes anti-dated commits, so the repository page shows a clean project last touched months ago while the payload is already in the file. Socket’s guidance is to stop reading the rendered history and read the activity log instead. I would go further for anyone doing diligence on a dependency: the commit log is an artefact the attacker controls, which puts it in the same category as a screenshot.

One thing I will not claim. Every attribution in this article is a private company’s assessment, several of them stated at medium confidence by the firms themselves. There is no indictment, no sanctions designation, and no court finding behind any of it. The convergence is genuine, four firms reaching compatible conclusions from different data, and it is still not a verdict.

What reduces your exposure

Split this by who you are, because the honest answer is different for a developer and for somebody who just owns coins.

If you build software. Every control below appears in CISA’s own alert or in the axios maintainer’s post-mortem. That is the reason for the specific list.

  • Commit the lockfile and install from it.npm ci installs the exact resolved tree in package-lock.json and fails if the manifest and lockfile disagree. npm install is free to resolve a caret range to something published four minutes ago. This is the single difference between a build that is reproducible and a build that is a subscription to a maintainer’s account.
  • Pin, and add a release-age floor. CISA’s wording is “pin npm package dependency versions to known safe releases”, plus min-release-age=7 in .npmrc. Seven days is not a guarantee and a patient actor outlasts it. It would have excluded the 2 hour 54 minute axios window, the 2 hour chalk and debug window, and the 5 hour Ledger window, which is most of the recorded exposure in this article.
  • Turn off install scripts.ignore-scripts=true in .npmrc. The axios payload ran entirely from a post-install hook and never touched application code, so nothing you review in the diff would have shown it. Some packages need their scripts to build, so allow those individually rather than leaving the door open globally.
  • Publish through a provenance flow, if you maintain anything. Saayman’s own list of changes is worth copying: OIDC publishing, immutable releases, and no publishing from a personal account. His stated lesson: “Publishing directly from a personal account was a risk that could have been avoided.”
  • Rotate on exposure, not on confirmation. Every advisory here says the same thing: treat the machine as compromised, rotate from a different machine. CISA’s list is specific about which secrets, including CI/CD secrets injected into an ephemeral run that no longer exists.
  • Read the activity log, not the commit log, on any repository you are evaluating. Socket’s point about force-pushed anti-dated commits applies to code review generally.

If you hold crypto and also write code, this is the rule. Do not develop on the machine that holds keys. Not a separate browser profile, not a separate user account, a separate machine or at minimum a virtual machine you can throw away. Every campaign in this article ends at the same place: the attacker gets code execution on a developer endpoint and then looks for wallet material. Panther’s own list of targets is the search order: wallet key material, cloud credentials, SSH keys, browser cookies, Telegram Desktop sessions, .npmrc, .env. If none of that is on the box, an install-time RAT gets a build environment.

Sign on hardware for anything that matters, with the limitation attached. Expel’s data is the strongest field evidence I have seen for this: the attacker had persistent access to thousands of machines and Expel assesses that wallets behind hardware tokens were unlikely to be drainable anyway. That reduces this specific risk substantially. It does not remove others. A hardware device solves key extraction and it does not tell you the transaction is the one you intended, which is the failure that produced the largest theft in the asset class and the failure Ledger’s own drainer incident exploited, where the device signed exactly what the compromised page asked it to sign. The on-device screen is only a control when the device can decode the call, which is the argument in the cold wallet guide.

If you are an ordinary holder, say the honest thing. You are downstream of all of this and you cannot inspect any of it. You did not choose axios, the developer of an application you use did, and neither of you was consulted about plain-crypto-js. There is no diligence available to you at the package layer, and anyone who tells you to audit your dependencies is describing a job you do not have.

What is available to you is where the keys live. A key that only exists on a hardware device, used to sign transactions you can read on that device’s own screen, is not sitting in a file that a compromised build step can find. That reduces certain risks and leaves others intact: it does nothing about market risk, nothing about you approving a transfer you should not have approved, and nothing about a platform holding your assets going insolvent. This article ends here, with no product attached, because the failure it describes happens on other people’s machines several steps upstream of yours. The last link in that chain is the only one you control.

Sources

Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.

More from the journal

Continue reading.