A supply chain attack compromised the Axios NPM package by injecting a malicious dependency 'plain-crypto-js' into versions 1.14.1 and 0.30.4. This dependency acts as an obfuscated dropper for the WAVESHAPER.V2 backdoor, targeting Windows, macOS, and Linux systems. [Auto-archived: reprocess_no_remaining_articles — 2026-04-01T01:38:38.873Z]
| Vendor | Product | Versions |
|---|---|---|
| Google Threat Intelligence Group | axios | 1.14.1, 0.30.4, 4.2.1 |
Updated vendor to Google Threat Intelligence Group, added new affected version 4.2.1, changed severity to HIGH, updated CVSS estimate to 7.5, added new CWE, IOC, and MITRE ATT&CK technique T1071.001.
Initial creation
