On March 31, 2026, an attacker compromised the axios lead maintainer’s account through social engineering and a remote access trojan, publishing two malicious package versions (1.14.1 and 0.30.4) that injected a cross-platform trojan. The malicious versions were live for approximately three hours before removal. As Simon Willison details, the attackers impersonated a company founder, created a convincing fake Slack workspace with realistic channels and profiles, and tricked the maintainer into installing malware disguised as a Teams update during a scheduled meeting. The maintainer said the playbook mirrored one Mandiant documented in February for the North Korea-nexus actor UNC1069, which lured crypto and fintech targets into spoofed Zoom calls and used a fake audio problem as the excuse to have them run “troubleshooting” commands. Pro tip for open-source maintainers: if the “CEO” wants you to install a custom Teams client, maybe don’t.
