It is exactly this backdoor that had Google conclude this was a North Korea-sponsored campaign. GTIG said WAVESHAPER.V2 is an ...

North Korean hackers published backdoored versions of the Axios NPM package using a compromised long-lived access token.