Skip to content
Briefings are running a touch slower this week while we rebuild the foundations.See roadmap
Cybersecurity: Threats and Defences
20MAY

UNC1069 expands the npm WAVESHAPER supply chain

3 min read
09:58UTC

Google's Threat Intelligence Group confirmed two additional npm packages distributing the DPRK-linked WAVESHAPER.V2 backdoor beyond Axios: @shadanai/openclaw and @qqbrowser/openclaw-qbot, picked up through automated dependency resolution on 31 March.

TechnologyDeveloping
Key takeaway

DPRK-nexus implants spread through transitive dependency resolution, beyond the single maintainer phishing vector.

Google's Threat Intelligence Group (GTIG) confirmed on Monday 11 May 2026 that two additional npm packages, @shadanai/openclaw and @qqbrowser/openclaw-qbot@0.0.130, were distributing the WAVESHAPER.V2 backdoor alongside the previously reported Axios compromise 1. Both packages picked up the malicious dependency during automated dependency resolution inside the 31 March 2026 injection window attributable to UNC1069, the North Korea-nexus threat cluster. The @qqbrowser/openclaw-qbot package shipped a compromised Axios@1.14.1 inside its own node_modules directory.

UNC1069's original Axios maintainer phishing, disclosed by GTIG and Mandiant on 5 May 2026 , affected Axios versions with approximately 100 million and 83 million weekly downloads. The new finding shifts the blast-radius model. WAVESHAPER.V2 is now reaching install bases that never directly downloaded a compromised Axios version, only a package that resolved to it transitively. For node-based services, the dependency tree two or three layers below the production lockfile is the distribution surface, not the package the developer typed at the command line.

The @shadanai and @qqbrowser namespaces suggest pre-seeded dependency traps rather than a second targeted maintainer compromise. That changes the response cost. Maintainer phishing is a single-incident defence with multifactor authentication and out-of-band credential rotation. Pre-seeded traps require lockfile-level review of every transitive resolution, every time a package updates. WAVESHAPER.V2 is a cross-platform backdoor for Windows, macOS, and Linux; once resolved into a build, it carries the same DPRK-nexus implant capability regardless of which top-level dependency triggered the resolution.

Deep Analysis

In plain English

A North Korea-linked hacking group that had already hidden malware inside a popular JavaScript library called Axios added two more smaller packages to its supply-chain attack on 31 March 2026. Developers who installed these packages unknowingly got the same malware, even if they never directly used Axios.

First Reported In

Update #4 · AI joins the breach column on both sides

Google Threat Intelligence Group· 20 May 2026
Read original
Causes and effects
This Event
UNC1069 expands the npm WAVESHAPER supply chain
The Axios compromise was not the blast radius; it was the visible event. Automated dependency resolution is now the distribution layer DPRK actors are aiming at, not the maintainer phishing alone.
Different Perspectives
Tsinghua University Institute for International Strategic Studies
Tsinghua University Institute for International Strategic Studies
Beijing-aligned commentary rejects US attribution of PRC-nexus clusters (UNC2814, APT45, UAT-8616) as politically motivated framing, characterising the April sixteen-agency joint advisory as coordinated Western pressure rather than independent technical assessment.
Google Threat Intelligence Group
Google Threat Intelligence Group
GTIG's 11 May report establishes AI-assisted offence and AI-infrastructure targeting as concurrent named-incident categories, not theoretical ones: UNC6780 attacked LiteLLM and Cisco AI Defense in parallel; state actors used Gemini operationally; CANFAIL and LONGSTREAM used LLM-generated queries to evade static analysis.
Cisco
Cisco
Cisco has not confirmed the UNC6780 breach scope beyond the named AI Defense and AI Assistant projects; GitHub confirmed an investigation. CVE-2026-20182 is the sixth Cisco SD-WAN KEV entry in 2026, reaching that milestone the same week UNC6780's source-code visibility into the portfolio became public.
NCSC
NCSC
The ICO's South Staffs Water fine applies NCSC PAM and monitoring guidance as the GDPR Article 32 enforcement baseline against a water-sector CNI operator, extending the Capita precedent before the CS&R Bill has reached Royal Assent. NCSC guidance now carries enforceable weight inside the existing statutory framework for CNI sectors processing personal data.
Microsoft Security Response Center
Microsoft Security Response Center
The Exchange Emergency Mitigation Service URL rewrite is the sole available mitigation for CVE-2026-42897; MSRC has not signalled an out-of-band patch timeline. The workaround breaks OWA calendar print, inline images, and Light mode, forcing CISOs to choose between user-experience breakage and active-exploitation exposure.
CISA
CISA
CISA's Exchange CVE-2026-42897 deadline of 29 May, set before Microsoft published a patch, repeats the PAN-OS posture from 6 May: exploitation velocity now overrides vendor release timelines. BOD 22-01 compliance against an unpatched flaw leaves federal CISOs with only mitigation documentation and mailbox-rule monitoring.