Supply chain attack on Axios npm package: Scope, impact, and remediations

This report documents a confirmed supply-chain compromise of the popular Axios npm package where attackers published malicious versions (1.14.1 and 0.30.4) that pull a dependency named "plain-crypto-js" which runs a postinstall dropper (setup.js, SHA256: e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09) contacting C2 sfrclak.com to deploy a cross-platform RAT capable of credential and API key theft; organizations are advised to treat affected hosts as fully compromised, quarantine, rotate secrets, and scan for the listed IOCs.