Axios Front-End Library npm Supply Chain Poisoning Alert

NSFOCUS CERT reports that the Axios npm package was deliberately poisoned: attackers hijacked a maintainer account, released malicious versions (1.14.1 and 0.30.4) that install a cross-platform remote-access trojan through a dependency (plain-crypto-js), and used self-deletion and disguised package files to evade detection; the advisory includes IOCs, detection commands, and remediation recommendations (downgrade to safe versions, remove malicious dependency, rotate credentials, and audit CI/CD).