Axios NPM Packages Breached in Ongoing Supply Chain Attack

A supply-chain attack compromised Axios npm releases (1.14.1 and 0.30.4) by publishing a malicious dependency [email protected] and using an npm postinstall dropper (setup.js) that installs a multi-platform remote access trojan. The malware uses two-layer obfuscation, fetches platform-specific payloads (Mach-O on macOS, PowerShell/VBScript on Windows, detached Python on Linux), communicates with C2 via deceptive HTTP POSTs, and erases installation traces; the intrusion likely exploited a compromised long-lived npm publishing token with permissions exceeding maintainers.