axios compromised on npm: maintainer account hijacked, RAT deployed

A malicious actor compromised the npm account of axios's primary maintainer and published two malicious releases ([email protected] and [email protected]) that add a dependency ([email protected]) whose postinstall hook deploys a cross-platform remote access trojan for macOS, Windows, and Linux; the attack impacted a widely used library with ~100M weekly downloads, the dropper self-deletes to evade inspection, and the report provides IOCs (shasums, C2 domain, file paths), detection commands, and remediation steps including pinning safe versions, removing the dropper, rotating credentials, and auditing CI/CD logs.