Axios NPM Distribution Compromised in Supply Chain Attack

An unknown threat actor compromised the npm account of an axios maintainer, publishing two malicious versions of the package. These versions introduced a dependency on plain-crypto-js, a newly created malicious package. Despite quick removal, axios's widespread usage led to rapid exposure. The malicious package includes a dropper that downloads and executes platform-specific second-stage payloads, functioning as remote access trojans. These payloads can execute remote shells, inject binaries, browse directories, list processes, and perform system reconnaissance. Organizations are advised to audit their environments, remove malicious artifacts, rotate exposed credentials, investigate potential compromise paths, and monitor for suspicious activity.

• Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party ScriptCampaign2026-10-30
• Inside Coruna and DarkSword Chains: From Web Lures to iOS ExploitationMalware2026-10-29
• Fake "View & Sign" and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect ClientsMalware2026-10-29
• Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analyticsCampaign2026-10-27
• Inside ICMacOS: From an Infostealer to a Persistent RATMalware2026-10-27