Axios supply chain attack chops away at npm trust

Malicious npm packages masquerading as legitimate Axios releases ([email protected] and [email protected]) and a dependency ([email protected]) were published using compromised maintainer credentials. The packages used a postinstall script to download an obfuscated dropper that retrieved platform-specific RAT payloads (macOS, Windows, Linux), potentially exposing secrets from developer/build environments; identified IOCs include domain sfrclak.com, IP 142.11.206.73, file paths on macOS/Linux/Windows, and SHA-256 checksums for the malicious packages.