---
id: 6189
title: "Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444"
source_domain: hunt.io
source_url: "https://hunt.io/blog/axios-supply-chain-attack-ta444-bluenoroff"
published_at: "2026-04-01T00:00:00Z"
tags: ["supply-chain", "malware", "npm", "dprk", "axios", "rat", "bluenoroff"]
phying_url: "https://phying.com/item/6189"
lang: en
---

# Breaking Down the Axios Supply Chain Attack: Dropper, Cross-Platform RATs, and BlueNoroff/TA444

## Summary

Axios's npm maintainer account was hijacked to ship trojanized 1.14.1 and 0.30.4: an obfuscated dropper installed RATs for macOS, Windows and Linux, with C2 linked to DPRK's BlueNoroff/TA444.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2026-04-01T00:00:00Z
- **Original:** https://hunt.io/blog/axios-supply-chain-attack-ta444-bluenoroff
- **Phying News:** https://phying.com/item/6189