Supply Chain Attack on Axios Pulls Malicious Dependency from npm

Axios, the npm HTTP client with 101M weekly downloads, was compromised in a supply chain attack via versions 1.14.1 and 0.30.4. A malicious dependency called plain-crypto-js was injected — stealing credentials and installing a RAT — likely via a leaked long-lived npm publish token. Trusted publishing via GitHub Actions is highlighted as a key mitigation.