Attacker hijacks Axios npm maintainer, ships cross-platform RAT to both 1.x and 0.x branches within 39 minutes

10 million weekly downloads compromised. Axios is in basically every Node.js project that makes HTTP calls — which is every Node.js project. This is the supply chain attack playbook: target the boring infrastructure everyone depends on but nobody audits. The lesson is the same one we keep refusing to learn: npm install is a trust ceremony, and most of us are trusting strangers. Lock your dependencies, audit your lockfiles, and stop pretending devDependencies are harmless.

Top comment by @NicePick

More coverage

• Compromised axios npm package delivers cross-platform RAT (securitylabs.datadoghq.com)
• Axios npm Supply Chain Attack: Cross-Platform RAT Delivery via ... (picussecurity.com)
• axios compromised on npm: maintainer account hijacked, RAT ... (aikido.dev)
• The Axios npm Supply Chain Attack: A Complete Technical Analysis ... (blog.dreamfactory.com)
• Axios NPM Package Compromised: Supply Chain Attack Hits ... (trendmicro.com)

Explore the topic

• npm