Axios Compromised in Major Supply Chain Attack Affecting Millions.
Axios Hit by Critical Supply Chain Attack: Malware Injected into 100M-Download Library Axios , one of the world's most popular HTTP clients with over 100 million weekly downloads , has fallen victim to a sophisticated supply chain attack. Threat actors successfully injected a Remote Access Trojan (RAT) into versions 1.14.1 and 0.30.4 . The malicious code remained active for approximately two and a half hours before being detected and removed. The Mechanism of Attack: Dependency Poisoning The attackers utilized a "Dependency Poisoning" technique. They first published a malicious package named plain-crypto-js and subsequently modified the Axios source code to include this package as a dependency. While Axios typically uses GitHub Actions for automated builds and publishing, these compromised versions were uploaded directly from a manual account associated with the email ifstap@proton.me . How the Malware Operates The primary Axios code did not contain the malware direct...