The 39-Minute Sabotage: How State-Sponsored Hackers Hijacked 100 Million Axios Downloads

A North Korean threat actor compromised the npm account of the axios JavaScript library's primary maintainer, injecting a malicious dependency that deployed a backdoor called Waveshaper.v2 across Windows, Linux, and macOS putting over 100 million weekly downloads at risk. The attack was highly coordinated, with malicious payloads staged 18 hours in advance and both release branches poisoned within 39 minutes, marking it as one of the most operationally sophisticated supply chain attacks ever documented against a major npm package.