On March 31, 2026, North Korean threat actors compromised the widely used Axios npm package by stealing a maintainer’s credentials and publishing two backdoored versions that deploy the ZshBucket malware across Windows, macOS, and Linux. Any organization whose software build pipeline installed the trojanized versions may have introduced a persistent, cross-platform backdoor with remote access and data exfiltration capabilities into production systems. Fintech and cryptocurrency organizations face elevated risk given BlueNoroff’s established targeting pattern, but any Node.js-dependent environment is potentially affected.