Axios supply chain attack victim posts postmortem to prevent a repeat

Axios lead maintainer published a GitHub post-mortem after a supply-chain compromise of axios@1.14.1 and axios@0.30.4.

The attacker injected plain-crypto-js@4.2.1 which ran post-install scripts that delivered platform-specific RATs connecting to sfrclak.com:8000.

The incident is attributed to North Korean group UNC1069 and affected installs between 00:21 and 03:15 UTC on March 31.

Axios plans to adopt OIDC-based publishing, immutable releases, and update GitHub Actions to prevent similar attacks.