Hackers Poison Axios npm Package with 100 Million Weekly Downloads

On 31 March 2026, attackers hijacked maintainer accounts for the Axios npm package and published poisoned releases (1.14.1 and 0.30.4) that pulled a fake dependency, plain-crypto-js, which deployed a cross-platform RAT/infostealer that exfiltrated sensitive files and cloud API tokens and beaconed to a C2 at sfrclak.com:8000; systems that performed installs between 00:21 and 03:40 UTC should assume compromise and follow recommended full wipe and credential rotation.