Axios npm compromise traced to targeted social engineering attack

The Axios npm package was compromised after a targeted social-engineering attack against its maintainer, allowing attackers to publish malicious releases that deployed a cross-platform remote access trojan; the incident highlights critical software supply-chain risk as the malicious code could spread transitively across many JavaScript projects and evade standard protections by leveraging the maintainer’s authenticated environment.