A cyberattack that briefly compromised the widely used open-source project Axios on March 31 followed weeks of contact with one of its maintainers, according to an analysis from project maintainer Jason Saayman.
Saayman said the suspected North Korean hackers began targeting him about two weeks before they gained control of his computer and published malicious code to the project.
According to Saayman, the attackers posed as a real company, created a realistic Slack workspace, and used fake employee profiles to build credibility. He said they later invited him to a web meeting that prompted him to download malware disguised as an update needed to join the call.
Saayman said the tactic resembled methods previously linked to North Korean hackers by Google security researchers, including attacks used to gain remote access and steal cryptocurrency.
After gaining remote access to Saayman’s computer, the attackers published two malicious Axios packages, he said. The packages were removed about three hours after they were first published on March 31, but they may have infected thousands of systems during that time. The full scope of the incident was not yet clear.
Systems that installed a malicious version of the software may have exposed private keys, credentials, and passwords, potentially leading to additional breaches.
The incident underscored the risks facing maintainers of widely used open-source software, which can serve as entry points to large numbers of devices and networks.
North Korean hackers remain one of the most active cyber threats online and were blamed for stealing at least $2 billion in cryptocurrency in 2025 alone.
North Korea remains under international sanctions over its nuclear weapons program and outside the global financial network. The country has long been accused of using cyberattacks and cryptocurrency theft to generate revenue.