HUGE supply chain attack

A supply chain attack compromised the Axios npm package, one of the most widely used JavaScript HTTP client libraries with over 100 million weekly downloads. An attacker gained access to a maintainer's npm account (reportedly via a recovery code) and published malicious versions (1.14.1 and 0.30.44) containing a backdoor dependency called plain-crypto-JS. Any environment that ran npm install during the ~3-hour exposure window may be compromised. The malware delivers a cross-platform RAT targeting Windows (PowerShell-based), Linux, and macOS (Python-based), establishing C2 communication to sfrclack.com:8000, exfiltrating files, and setting registry persistence on Windows. Mitigation steps include auditing package-lock.json files for malicious versions, scanning for indicators of compromise, and rotating credentials on any potentially affected hosts.