Critical Supply Chain Attack on Axios npm Package Delivers Malware

**Critical supply-chain compromise of axios (31 March 2026):** Attackers hijacked the lead maintainer's npm account and published two malicious axios releases that included a dependency executing a post-install cross-platform remote access trojan (macOS, Windows, Linux); the malicious packages were pre-staged 18 hours earlier, available for ~3 hours, and were downloaded by many developers and CI/CD pipelines, prompting urgent advice to audit dependencies and treat affected systems as compromised.