With zero vulnerabilities, how did hackers take over millions of development environments worldwide? — A deep dive into the UNC1069 supply chain hunting scheme

A Three-Week, 800-Million-Monthly-Download Precision "Hunt"

Last week, the Axios supply chain poisoning incident sent shockwaves through the security community. The news has already spread far and wide: the attacker is the North Korean state-sponsored hacker group UNC1069.

But rather than focusing on who did it, we should pay more attention to how they succeeded.

This was no longer a simple brute-force crack, but a highly patient, weaponised attack targeting trust links. UNC1069 spent a full three weeks: disguising their identities on LinkedIn, negotiating partnerships, and even coordinating video conferences around the maintainer's schedule, ultimately compromising the chief maintainer's credentials through a disguised video conferencing tool (the malicious payload FLATDIRT).

What is terrifying is not the name of the hacker group, but the fact that they have already thoroughly understood the structural blind spots of software supply chain defence:

1. Developers blindly trust official registry sites.

2. CI/CD processes blindly trust package.json.

3. Enterprise security teams are trapped in a passive response loop of "manually inspecting lists only after an incident occurs."

   

Full-Link Attack Analysis

UNC1069: North Korea's State-Level Supply Chain Hunter

UNC1069 is an advanced persistent threat (APT) group backed by the North Korean state, with economic gain as its core driver.

This is not the first time UNC1069 has appeared in supply chain attacks. The attack library of the Cyber Security Intelligence Security Validation Platform has currently tracked more than a dozen attack actions of UNC1069, including the three tools confirmed to have been used in this incident:

• WAVESHAPER.V2: A cross-platform remote access Trojan (RAT) supporting Windows / macOS / Linux, triggered via postinstall hooks and featuring anti-forensics self-deletion.

• FLATDIRT: A malicious payload delivery tool used in the initial intrusion phase, disguised as a "technical issue fix file" in social engineering scenarios.

• LONGWAIT: A persistence waiting module that resides silently after infection, waiting for the optimal opportunity to steal high-value credentials.

The combination of these three tools outlines a complete attack path: social engineering to establish trust → FLATDIRT to deliver the payload → WAVESHAPER.V2 to establish remote control → LONGWAIT to wait and steal npm credentials → hijacking the account to publish malicious versions.

This was not an opportunistic crime. It was the targeted execution of UNC1069's long-accumulated supply chain attack experience on a high-value target.

Currently, Cyber Security Lab has completed a deep analysis and replication of this full-link attack. Users of the Cyber Security Intelligence Security Validation Platform can now leverage the platform's hands-on validation capabilities to personally measure their enterprise line of defence's actual interception efficacy against this group's typical adversarial techniques.

The Social Engineering Chain: How They Got the npm Account

To understand what is truly shocking about this attack, one needs to look at the timeline in its entirety.

What Axios chief maintainer Jean Burellier went through is a perfect epitome of UNC1069's social engineering techniques:

It is worth noting that Jean was not the only target. During the same period, UNC1069 simultaneously approached several top-tier maintainers in the Node.js ecosystem:

• Pelle Wessman
  (Maintainer of the Mocha testing framework): Encountered a phishing meeting disguised as Streamyard.

• Matteo Collina
  (Node.js Technical Steering Committee member): Received suspected social engineering messages on Slack, narrowly avoiding the trap.

• Scott Motte
  (Creator of dotenv): Was approached; dotenv has over 50 million monthly downloads.

• John-David Dalton
  (Creator of Lodash): Targeted around the same time; Lodash has over 400 million monthly downloads.

The maintainer projects targeted by UNC1069 in this single round of approaches have a combined monthly download volume of over 800 million.

Why Open Source Maintainers Have Become Strategic Targets

UNC1069's choice is driven by clear strategic logic.

The logic of traditional cyber attacks is: compromise one machine = compromise one machine. But the logic of supply chain attacks is: compromise one maintainer account = automatically inherit the trust of all users behind that account.

Axios has nearly 100 million weekly downloads. This means a single account hijack can, within just a few hours, silently plant backdoors into millions of development environments worldwide performing npm install — no vulnerabilities, no intrusion, just a "normal dependency update."

This is a fundamental shift from "fishing one by one" to "hijacking the distribution pipeline."

Attackers already understand clearly: the software distribution pipeline is one of the largest trust amplifiers on the internet. Developers trust official registries, CI/CD trusts package.json, and production environments trust CI/CD — each layer silently passes upstream trust down to the next, with no one stopping to ask a question.

And UNC1069's patience makes this type of attack even harder to detect. Three weeks of slow chatting, no rushing, no letting the cat out of the bag, waiting until you let your guard down completely. Socket researchers provided an accurate description of this technique: "This is not a single-click bait; you simply have no idea that you are being hunted."

Such Attacks Will Only Increase; Enterprises Need Pre-configured Defence Systems

Although we have answered "who UNC1069 is and how they attacked".

But there is an uncomfortable reality here: even if we analyze UNC1069 down to the bone, there will be another group tomorrow, and the techniques will be even more sophisticated the day after. Threat perception is always a step behind the actual attack. Relying on the logic of "responding only after seeing a threat" is destined to be passive.

This Axios incident also exposed a deeper problem: for most enterprises, whether a malicious package has entered, which version it is, and which projects are affected — the answers to these questions come from post-incident manual inspection rather than a queryable system that is ready at any time.

This is the structural blind spot of software supply chain defence: perception is passive, defence is after-the-fact, and there is almost no control over the introduction of dependencies on the development side.

A truly effective defence is not about responding to a specific attack, but establishing a closed-loop system where "the line of defence is already in place before the attacker succeeds."

Cyber Security Four-Layer Defence System: Perception — Interception — Inventory — Governance

Layer 1: Real-Time Threat Intelligence Perception

Core Question: Is this package safe right now?

At 11:19 AM on 31 March, the Cyber Security Advanced Persistent Threat Intelligence Platform completed the threat labelling for axios@1.14.1, 41 minutes ahead of npm's official release. The intelligence accuracy reaches the package name + version level — not "'axios' might have issues," but "'1.14.1 is malicious, while 1.14.0 is clean'", which completely changes the disposal logic.

The complete correlation from the malicious package to C2 domains and attack IPs is also compiled simultaneously — allowing users to see the entire attack chain on a single details page, supporting blocking and tracing.

Value in the UNC1069 Scenario: The moment a maintainer's account is hijacked is beyond your control. But with every npm install after the intelligence is compiled, you can be protected at the same time you are notified.

Layer 2: Interception at Artifact Download Nodes

The value of intelligence is to "be protected," not just "be notified."

The software supply chain security gateway is deployed in reverse proxy mode between the enterprise artifact repository (Nexus / JFrog Artifactory) and public package sources (npm / PyPI / Maven). Developers do not need to alter any workflows; npm install runs as usual, and all requests flow through the gateway.

The gateway supports two operating modes, which can be hot-swapped in real time:

• Detection Mode: Alert triggered, package passes normally (suitable for development environments, does not affect business operations)

• Interception Mode: Blocked directly, malicious packages do not land (suitable for production CI/CD environments)

Value in the UNC1069 Scenario: Even if Jean's account was hijacked and axios@1.14.1 was pushed to the npm registry — as long as the gateway triggered interception after the intelligence synchronised at 11:19, any subsequently executed npm install axios@1.14.1 would be blocked at the network layer, preventing malicious code from ever landing on your development machines or CI/CD environments.

Layer 3: Inventorying Risk of Existing Assets (SBOM)

The first difficulty many enterprises faced on 31 March was this question: Exactly how many of my projects are using axios? Which version is it?

With dependency trees growing deeper and transitive dependencies increasing, the answer to this basic question should not come from manual inspection.

SBOM (Software Bill of Materials) turns "what I used" into a queryable archive. The platform supports importing both SPDX and CycloneDX standard formats, and automatically compares them with the intelligence database upon import: which projects have affected versions, the extent of risk exposure, and cross-verification with interception alerts.

Value in the UNC1069 Scenario: The impact assessment is shortened from "hours of manual inspection" to "minutes of system queries."

Layer 4: R&D Behaviour Governance — The Prerequisite for True Implementation of the System

The first three layers solve perception, interception, and inventory. But there is a more fundamental question left unanswered: What if R&D personnel bypass these controls?

This is not a hypothesis; it is a daily reality:

• Developers locally configure npm config set registry https://registry.npm.taobao.org, completely bypassing the enterprise gateway.

• AI programming tools (such as OpenClaw mentioned in the previous article) automatically pull third-party Skill files, leaving developers with no idea of what has transpired.

• Newly integrated CI/CD pipelines forget to configure the enterprise proxy source.

No matter how well the first three layers are executed, as long as the "passageway" is left open, it is as good as useless.

Effective governance requires:

1. Forcing artifact requests through the software supply chain security gateway: Restricting direct access to public sources at the network layer or CI/CD level is the prerequisite for interception capabilities to work.

2. Skill source control for AI programming tools: The attack surface of the Skill supply chain is expanding rapidly, and it needs to be integrated into an intelligence verification system of the same level as code packages.

3. RBAC Hierarchical Permissions: Core systems strictly intercept, while development environments only alert, avoiding security policies affecting R&D efficiency.

4. Complete Audit Trails: Every alert, rule change, and whitelist operation automatically generates an audit record, providing a complete chain for post-incident tracing.

The boundary of your security capability is determined by what you allow. No matter how accurate the intelligence or how strong the gateway, if the passageway is not managed, everything can be bypassed. Governance is not an extra burden; it is the foundation that makes the capabilities of the first three layers truly effective.

UNC1069 spent three weeks, starting from a single LinkedIn message, to ultimately secure the npm credentials of the Axios chief maintainer; they then used that account to push malicious code to millions of development environments worldwide within hours.

There were no vulnerability exploits or brute-force cracks in the entire process. There was only patience, disguise, and a precise understanding of the fundamental vulnerability that is the "open-source ecosystem trust model."

This will not be the last time. Techniques will only become more sophisticated, targets will only increase, and the next maintainer might already be in the process of being approached right now.

The ultimate moat of supply chain security is not about knowing who the attacker is, but ensuring that your line of defence is already in place before they succeed.