North Korean hackers and the Axios library

A cybersecurity incident has occurred that clearly demonstrates how vulnerable modern digital infrastructure is. Suspected hackers linked to North Korea compromised a developer’s account and injected malicious code into one of the most widely used JavaScript libraries — Axios.

Axios is used in millions of projects worldwide, from corporate websites to crypto services. This makes the attack particularly dangerous. A compromised update could have affected a vast number of systems, potentially giving attackers access to private keys, user accounts, and fund withdrawal infrastructure.

According to experts, the attack follows a supply-chain model — one of the most dangerous types of cyberattacks, where malicious code is injected not directly into a company, but through third-party software. In this case, the hackers had access to the Axios developer’s account for about three hours and used that window to distribute malicious updates.

Among the first victims are companies using vulnerable versions of the library. However, experts warn that this is only the tip of the iceberg. The scale of the compromise may grow significantly as organizations begin conducting checks and uncovering the impact of the attack.

Axios is used across nearly all sectors — from healthcare to finance. It is also widely used by crypto companies, making the incident especially sensitive for the digital asset industry. According to experts, attackers may have specifically targeted the crypto sector due to its liquidity and the difficulty of recovering stolen funds.

Mandiant, a Google-owned company, stated that the attack was carried out by one of the North Korean hacker groups. Experts expect that the data and access obtained may be used for further attacks aimed at stealing cryptocurrency. Such operations, they say, are often used to fund state programs in North Korea, including missile and nuclear development.

An interesting detail is that the attackers had access to the developer’s account for about three hours — enough time to launch the attack. After the breach was discovered, the developer and cybersecurity specialists had to urgently regain control and assess the damage.

Researchers estimate that around 135 infected devices have already been identified across approximately 12 companies. However, these are only preliminary figures — the real number of affected systems could be much higher.

The attack fits into a broader pattern of North Korean cyber activity. Similar incidents have occurred before, when attackers infiltrated software supply chains and targeted companies across various industries, including healthcare and hospitality.

Rodong Sinmun/KCNA/File

Cyber operations have become an important source of funding for North Korea. According to international reports, North Korean hackers have stolen billions of dollars from banks and crypto companies in recent years. In 2023, according to White House officials, around half of the country’s missile development program was funded through such digital attacks.

Last year saw the largest recorded cryptocurrency theft attributed to North Korean hackers — approximately $1.5 billion in a single attack. This demonstrates the scale and sophistication of such operations.

Experts note that these attacks are not accidental but part of a systematic strategy. Hackers are unconcerned with reputation or exposure, allowing them to operate openly and at scale. Despite the high “noise” of their operations, the approach remains effective enough to justify the risks.

A particular concern, according to specialists, is the development of artificial intelligence technologies. Companies increasingly deploy AI agents that automatically write and implement code without proper review. This introduces additional vulnerabilities, as human oversight in the development chain is reduced.

Experts emphasize that the main weakness of modern software ecosystems is excessive trust in ready-made components and insufficient control over what actually enters the codebase. It is through such “open doors” that attacks like the one on Axios occur.

In the end, the Axios incident serves as another reminder that even the most widely used and trusted tools can become entry points for large-scale attacks. And as digital technologies become more deeply embedded in the economy, the cost of a single vulnerability only increases.