Elastic releases detections for the Axios supply chain compromise

Elastic Security Labs describes a supply-chain compromise of the axios npm package (malicious versions 1.14.1 and 0.30.4) that added a transitive dependency ([email protected]) which executed during installation to fetch and launch cross-platform second-stage RATs; the report details platform-specific delivery/execution chains, persistence mechanisms, C2 indicators, file and network IOCs, and behavioral detection rules that reliably catch the installation-to-delivery stage across Linux, Windows, and macOS.