sapphire sleet

Sapphire Sleet is a North Korean state actor tracked by Microsoft Threat Intelligence. On WindowsForum.com, the tag covers a March 2026 supply chain attack where two malicious npm releases of the Axios HTTP client were used to deliver a remote access trojan. The campaign targeted Windows, macOS, and Linux development environments and CI/CD systems, highlighting cross-platform risks from poisoned package updates. Microsoft urged organizations to roll back to safe versions. Discussions focus on the security implications for software supply chains and the need for vigilance in dependency management across platforms.