North Korean Actors — Axios npm Package Hijack

North Korean Actors — Axios npm Package Hijack

Axios npm Package Hijacked for Malicious Distribution

Confidence: High

Microsoft and Mandiant have confirmed a compromise of the axios HTTP client library, a dependency used by millions of JavaScript applications worldwide. According to their reporting, malicious versions of the package were pushed to the npm registry and contained remote access trojan (RAT) functionality. The attribution points to North Korean state-sponsored actors, marking this as a deliberate supply-chain operation rather than opportunistic vandalism.

Axios sits near the bottom of countless dependency trees. If your build pipelines, internal tools, or production services resolved a poisoned version during the exposure window, attackers gained immediate persistence. Internal developer tooling often runs with privileged access to source code and cloud credentials, not just public-facing applications.

Check your lockfiles now. Look for any axios resolutions outside known-good version ranges. Treat any build environment that consumed npm packages during the exposure period as potentially compromised until proven otherwise.

Windows IKEv2 Remote Code Execution

Confidence: High

April's Patch Tuesday includes CVE-2026-33824, an unauthenticated remote code execution vulnerability in Windows IKEv2 with a CVSS score of 9.8. The Internet Key Exchange protocol is foundational to many VPN gateway implementations. An unauthenticated RCE here means an attacker who can reach the service can likely execute code with elevated privileges.

IKEv2 exposure typically sits on perimeter gateways. The combination of network-facing placement and unauthenticated exploitation makes this a priority patching target for any organisation running Windows-based VPN infrastructure.

Microsoft Defender "BlueHammer" Patched

Confidence: High

CVE-2026-33825, the local privilege escalation vulnerability in Microsoft Defender known as "BlueHammer," now has a formal patch available. This shifts the operational guidance from monitoring to immediate deployment. The vulnerability allowed low-privileged users to escalate to SYSTEM through the Defender security platform itself.

If you deferred patching pending vendor confirmation, that confirmation is now available. This is not a theoretical risk — the attack chain has been public for some time.

Update: European Commission Breach Now at 91.7 GB, 30+ Entities Affected

Confidence: High

Yesterday's reporting on the Europa.eu breach has sharpened significantly. ENISA and SecurityWeek now link the incident to CVE-2026-33634 and TeamPCP's weaponisation of Trivy, the popular container scanner. The scope expanded from initial reports to 91.7 GB of data stolen, with over 30 EU entities reportedly affected.

This is the same lesson as yesterday, with harder numbers: security tools running with elevated cloud credentials have become the attack path.

Update: SharePoint Deadline Pressure Intensifies

Confidence: High

CVE-2026-32201 remains under active exploitation with a CISA KEV listing. Today's delta adds confirmed public proof-of-concept availability and an April 28 remediation deadline for federal agencies. The technical characterisation varies across sources (CVSS 6.5 spoofing vs higher operational ratings), but the guidance is unified: patch immediately.

Update: nginx-ui /mcp Attack Path Confirmed

Confidence: High

CVE-2026-33032 maintains its position in the urgent queue. Today's reporting adds specificity: the unauthenticated RCE targets exposed /mcp management endpoints. CVSS 9.8 severity combined with internet-facing management interfaces makes this a high-priority exposure check for any nginx-ui deployments.

Update: Adobe Acrobat Reader Zero-Day Continues

Confidence: Medium

CVE-2026-34621 remains actively exploited in the wild. The attack path leverages PDF documents, making legal, finance, and document-heavy user groups the primary risk population. Patch urgency holds for environments where PDF workflows are standard.

Belgium NIS2 Compliance Deadline (April 18)

Confidence: Medium

Belgian essential and key entities face a compliance deadline on 18 April 2026 for NIS2 demonstration. This shifts from "planning" to "prove it" — a useful trigger for compliance conversations with EU-facing clients.

Why This Matters

Today's findings centre on supply-chain trust failure, patch pressure on high-severity infrastructure, and EU compliance milestones. The axios compromise follows the same pattern as yesterday's Trivy disclosure: attackers are hitting the tools developers trust. Dependencies and security scanners have become direct attack surfaces.

The Microsoft April patch cycle adds IKEv2 and Defender to an already crowded urgent queue alongside SharePoint, nginx-ui, and Citrix. The European Commission breach confirms what we suspected: security scanners can be weaponised when they run with privileged credentials. Belgium's deadline gives EU-facing organisations concrete compliance pressure.

• Recommended Actions
• Audit axios dependencies immediately: Check package-lock.json, yarn.lock, and similar across all repositories; identify any resolutions outside trusted version ranges
• Validate IKEv2 exposure: Confirm patch status for CVE-2026-33824 on all Windows VPN gateways
• Deploy Defender patch: Roll out CVE-2026-33825 fixes without further deferral
• Trivy credential isolation: Review whether Trivy or similar scanners run with cloud credentials that could be weaponised
• SharePoint April 28 deadline: Accelerate patch validation for CVE-2026-32201
• nginx-ui /mcp exposure check: Inventory any exposed management endpoints and patch CVE-2026-33032
• Belgium NIS2 outreach: Use the 18 April deadline to open compliance conversations with EU-exposed accounts

All findings grounded in A13E intelligence sweeps through 06:30 UTC 16 April 2026.