Axios Under Siege: Critical npm Supply Chain Attack Hijacks Lead Maintainer to Drop Multi-Platform RAT

Security researchers warn that two malicious axios npm releases were published after a maintainer account was compromised; the releases include a hidden dependency (plain-crypto-js) whose postinstall script acts as a cross-platform RAT dropper that contacts C2 at sfrclak.com, stages payloads, executes shell commands, and deletes forensic artifacts — organizations should assume compromise, scan for IOCs, revert to known-good versions, rotate credentials, and harden CI/CD to block postinstall scripts.