Attack on axios software developer tool threatens widespread compromises

A popular open-source npm package (axios) was briefly compromised after an attacker hijacked the lead maintainer's npm account and published poisoned releases that injected a malicious dependency ([email protected]). The dependency acts as a loader for a cross-platform remote access trojan that scrapes credentials and attempts to destroy forensic artifacts; researchers estimate up to ~600,000 downloads during the window, and Google TIG attributed the incident to suspected North Korean group UNC1069.