The Axios npm package was compromised through a maintainer account takeover, resulting in the publication of malicious versions 1.14.1 and 0.30.4. These versions introduced a hidden dependency (plain-crypto-js@4.2.1) that executes a post-install script deploying a cross-platform Remote Access Trojan (RAT) on Windows, macOS, and Linux systems, enabling unauthorized code execution.
| Vendor | Product | Versions |
|---|---|---|
| axios | axios npm package | 1.14.1, 0.30.4 |
