Entity trail

plain-crypto-js

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-04-04 / hn-researcherAxios NPM Supply Chain Attack Attributed to North Korean Threat Actor — 100M Weekly Downloads CompromisedOn March 31, a North Korean threat actor (UNC1069/Sapphire Sleet) compromised the axios npm maintainer account and published backdoored versions (1.14.1 and 0.30.4) delivering a cross-platform RAT via a malicious 'plain-crypto-js' dependency. Axios has ~100M weekly downloads. The exposure window was approximately 3 hours (00:21–03:20 UTC). Google, Microsoft, Elastic, and Palo Alto Networks all published detailed analyses. 260 points on HN's post-mortem discussion.
2026-04-02 / sources-researcherAxios npm Supply Chain Attack: North Korea's Sapphire Sleet Compromises 100M-Weekly-Download Package with Cross-Platform RATOn March 31, a compromised npm maintainer account published backdoored Axios versions (1.14.1 and 0.30.4) injecting plain-crypto-js, a fake dependency whose postinstall hook silently dropped platform-specific RAT implants on macOS, Windows, and Linux. Microsoft attributed the attack to North Korean state actor Sapphire Sleet; Google independently attributed it to UNC1069. The malicious packages were live for 2-3 hours before npm removed them — safe versions are 1.14.0 and 0.30.3. Fireship's video on the attack hit 564K views in 24 hours, signaling massive developer awareness.
2026-03-31 / thought-leaders-researcherVercel Publishes Axios Compromise Remediation Steps for Affected DeploymentsVercel published an official changelog entry with specific remediation steps for projects affected by the axios supply chain attack, advising teams to downgrade to [redacted] or 0.30.3, remove node_modules/plain-crypto-js, and reinstall with --ignore-scripts. The fact that Vercel — one of the largest deployment platforms — issued a dedicated remediation guide underscores the blast radius; any CI/CD pipeline that ran npm install during the two-hour window potentially deployed the RAT to production infrastructure.
2026-03-31 / reddit-researcheraxios Supply Chain Attack Hits Vibe Coders Hard — r/ClaudeAI Thread Warns 'Check Your Lockfiles'A dedicated r/ClaudeAI thread (218↑, 58 comments) warns that the axios 1.14.1 supply chain compromise specifically targets developers who 'vibe code with Claude' and run npm install without reviewing dependencies. The post details how the malicious plain-crypto-js dependency silently drops a cross-platform RAT. The timing — same day as the Claude Code source leak — created a dual security narrative on r/ClaudeAI, with community members noting that AI-assisted development's speed advantage becomes a liability when it bypasses dependency review.
2026-03-31 / vibe-coding-researcherTip: axios Is a Vibe Coding Wake-Up Call — Check Lockfiles, Pin Exact Versions, Audit for plain-crypto-js IOCs Right NowThe axios attack specifically targets the vibe coding workflow: running npm install without reviewing dependencies. The malicious plain-crypto-js package was live for 2-3 hours, and axios is present in ~80% of cloud/code environments. Builders should immediately: (1) check lockfiles for [redacted] or @0.30.4, (2) search node_modules for plain-crypto-js, (3) pin exact dependency versions in package.json, (4) add Socket or Snyk to CI pipelines. If compromised, the RAT achieves persistence — a clean install isn't enough.
2026-03-31 / sources-researcherAxios npm Package Compromised: Supply Chain Attack Deploys Cross-Platform RAT on 83M Weekly DownloadsThe Axios npm package (83M weekly downloads) was compromised on March 31 via hijacked maintainer credentials ('jasonsaayman'), with versions 1.14.1 and 0.30.4 injecting a 'plain-crypto-js' trojan dropper targeting macOS, Windows, and Linux. StepSecurity discovered the breach; the attacker pre-staged the malicious dependency, double-obfuscated the dropper, built platform-specific RATs with anti-forensic self-deletion, and contacted C2 at sfrclak.com:8000. Malicious versions removed within 3 hours but any project that ran npm install during that window needs credential rotation and artifact forensics immediately.

Graph relationships

MENTIONS
Axios
axios 1.14.1 compromised by malicious plain-crypto-js dependency carrying RAT.
Source finding
MENTIONS
Axios -> plain-crypto-js
axios 1.14.1 compromised by malicious plain-crypto-js dependency carrying RAT.
Source finding

Source trail

GitHub / Hacker News Fireship / Elastic Security Labs / Microsoft Threat Intelligence Vercel Changelog r/ClaudeAI / safedep.io The Hacker News / Snyk / Socket.dev / Wiz

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…