One person stands between North Korea and your entire app. UNC1069 (Microsoft tracks the same cluster as Sapphire Sleet) spent two weeks impersonating a real, well-known company — with an AI-cloned founder modeled on the real person, a Slack workspace branded to the real company's CI channel, and weeks of rapport-building — to get the lead Axios npm maintainer onto a Microsoft Teams call. On that call, a fake 'Teams is out of date' prompt appeared on his screen; the moment the update was triggered, a remote-access trojan (WAVESHAPER.V2) deployed and harvested his npm credentials directly from disk. Attackers then used those credentials to publish two backdoored Axios versions (1.14.1 and 0.30.4) for nearly three hours (00:21–03:20 UTC). The same campaign hit other top maintainers (Lodash, ECMAScript polyfills, Fastify/Pino/Undici, dotenv, mocha, Socket engineers); they refused the lure. The maintainer fell because the lure that worked looked like the OS, not a stranger.
Threat-intel firm with on-record interviews of multiple targeted maintainers; primary for Act 5 cross-cohort claims
Verified 2026-04-22
How this was made. A.I. tools generated the animation, voice, and visual composition.
The facts, sourcing, and editorial decisions came from a human. Every claim in this video links to a
source above; every source was verified against its primary publication. The newsletter that started
this story is at contextwindowsec.com.