One of JavaScript's most popular libraries compromised by hackers — Axios npm package hit in supply chain attack that deployed a cross-platform RAT

An attacker compromised an Axios maintainer npm account and published malicious axios@1.14.1 and axios@0.30.4 releases.

The malicious releases added plain-crypto-js@4.2.1 which ran a postinstall script that contacted sfrclak.com and downloaded a cross-platform RAT.

The dropper ran within 1.1 seconds of install and wrote OS-specific payloads before deleting traces; vendors recommend treating affected systems as fully compromised.