Open-source attacks go beyond Axios: deception that exploits trust

The Axios malware incident appears to be part of a broader campaign targeting trusted JavaScript open-source maintainers.

Attackers used fake company identities, Slack invites, LinkedIn outreach, and fake video-call or app-install prompts to trick developers.

Popular Node.js and npm maintainers were targeted, raising the risk of malware spreading through trusted packages.