# Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack

North Korean actor social-engineered the axios maintainer with a fake Teams call and RAT, stole a long-lived npm token, and published trojanized axios 1.14.1/0.30.4.

- Payout: Real-world hack
- Severity: critical
- Program: axios
- Analysis by: StepSecurity
- Disclosed: 2026-04-09
- Write-up quality: 7/10
- Original: https://www.stepsecurity.io/blog/behind-the-scenes-how-stepsecurity-detected-and-helped-remediate-the-largest-npm-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-behind-the-scenes-how-stepsecurity-detected-and-helped-remediate-the-largest-npm-supply-chain-attac
- Tags: area:oss domain:oss impact:integrity impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:ci-cd tech:nodejs technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** npm package publishing pipeline and maintainer workstation
**Root cause:** Attacker social-engineered the maintainer into running a RAT disguised as a fix during a fake Teams call, then stole a long-lived npm access token that bypassed OIDC-based publishing controls.
**Steps:**
1. Attacker poses as a company founder and sets up a branded fake Slack workspace plus CI infrastructure to appear legitimate.
2. Schedules a Microsoft Teams video call with the maintainer.
3. During the call, shows a fake error message and tricks the maintainer into downloading a "fix" that is a remote access trojan.
4. RAT gives access to the maintainer's machine; attacker steals a long-lived npm access token.
5. Attacker publishes compromised axios versions `1.14.1` and `0.30.4` with an injected `plain-crypto-js` dependency, bypassing OIDC publishing controls.
6. Compromised package beacons to C2 `sfrclak.com` from installers/CI runners.
7. Attacker also uses the maintainer's GitHub account to delete warning issues (~20 times) until GitHub suspends the account.
**How found:** StepSecurity's AI Package Analyst flagged the new axios release as critical/rejected on publish, citing an undocumented unused dependency `plain-crypto-js`, a package.json/internal version mismatch, a missing CHANGELOG entry, and dropped provenance attestation; Harden-Runner independently observed an anomalous outbound call to `sfrclak.com` from CI runners.
**Exploitation:** Stolen long-lived npm token allowed direct publish of malicious axios versions to the registry, which silently installed a RAT on installers and CI/CD runners; the same actor used the maintainer's GitHub account to suppress community warnings in real time.
**Escalation:** Compromise of npm token plus GitHub account enabled both malicious publishing and active suppression of disclosure, maximizing the exposure window.
**Insight:** Long-lived npm tokens survive OIDC hardening; monitor for new dependencies that are never imported, version/CHANGELOG mismatches, and dropped provenance attestations, and correlate with CI egress to unknown domains.