Hackers compromise Axios npm package to drop cross-platform malware

Attackers hijacked the Axios npm maintainer account and published two malicious package versions that added a dependency executing a post-install dropper; the dropper fetched OS-specific RAT payloads for Windows, macOS, and Linux, used self-cleaning to hinder forensics, and exposed likely wide impact given Axios's large install base. Researchers published IoCs (including sfrclak.com) and recommend checking for [email protected], [email protected], and any plain-crypto-js package, rotating credentials, and downgrading to known-good Axios versions.