Google Threat Intelligence Group (GTIG) discloses a supply chain attack targeting axios. Between March 31, 2026, 00:21 and 03:20 UTC, the attacker embedded malicious dependency "plain-crypto-js" into axios NPM versions 1.14.1 and 0.30.4. The malicious postinstall script setup.js delivered the WAVESHAPER.V2 backdoor, affecting Windows, macOS, and Linux systems. This backdoor supports information collection, command execution, and file traversal, and communicates via C2 (sfrclak[.]com / 142 11 206 73). GTIG attributes this attack to the North Korea-linked group UNC1069, active since 2018, based on overlapping usage of WAVESHAPER.V2 and infrastructure. The incident originated from the compromise and tampering of the axios maintainer account, and officials recommend avoiding affected versions, auditing dependencies, isolating impacted systems, and rotating credentials.