Attack on axios software developer tool threatens widespread compromises

On March 31, 2026, an attacker hijacked the npm account of Axios’s lead maintainer and published two malicious Axios package releases that contained a hidden dependency installing a cross-platform remote access trojan; the poisoned releases were available for about 2–3 hours before npm removed them, raising major supply-chain compromise concerns for a library with ~100 million weekly downloads.