Axios on npm Compromised: Update Now 🚨

🚨 Axios was compromised on npm.

Attackers reportedly hijacked an Axios maintainer account and pushed two poisoned versions: 1.14.1 and 0.30.4.

The malicious releases added a fake dependency, plain-crypto-js, which security writeups say could download a cross-platform RAT affecting Windows, Linux, and macOS.

If you installed either version, treat that environment seriously:
✅ roll back
✅ rotate credentials
✅ investigate outbound activity

This is what modern supply chain attacks look like:
not fake apps…
but code developers already trust.

#axios #npm #javascript #cybersecurity #supplychainattack #malware #infosec #developers #nodejs #hackingnews #cybernews #devsecops #opensource #programming #roottohack