Top npm package backdoored to drop dirty RAT on dev machines

Attackers hijacked the npm account of axios's primary maintainer and published two malicious versions (axios@1.14.1 and axios@0.30.4) containing a remote-access trojan. The compromise bypassed GitHub Actions CI/CD by pushing packages manually via the npm CLI after swapping the account's email. A rogue dependency, plain-crypto-js@4.2.1, was staged 18 hours in advance and delivered cross-platform payloads for macOS, Windows, and Linux. Security firm StepSecurity called it one of the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package. Developers who installed either affected version are advised to assume full system compromise, rotate credentials, and potentially rebuild machines.