Hackers Hijack Axios npm Package to Spread RATs

Threat actors compromised the npm account of axios maintainer Jason Saayman and inserted a malicious dependency (plain-crypto-js) into axios, publishing v1.14.1 and v0.30.4 that deploy cross-platform remote access trojans; Google GTIG attributes the activity to UNC1069 (North Korea-nexus) and warns of widespread impact given axios's extensive use, while recommended mitigations include checking lockfiles, hunting for IOCs, and rotating credentials.