Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

Overview

The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency. Versions 1.14.1 and 0.30.4 of Axios have been found to inject "plain-crypto-js" version 4.2.1 as a fake dependency. According to StepSecurity, the two versions were published using the compromised npm credentials of the primary Axios

Organisations Involved

The following organisations are mentioned in relation to this incident: Account
The, Axios Supply Chain Attack Pushes Cross.

Multi-Source Coverage

This event has been reported across multiple outlets:

• Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account — thehackernews
• Hackers compromise Axios npm package to drop cross-platform malware — bleepingcomputer

Sources: bleepingcomputer, thehackernews. Aggregated by Cybernews Agency pipeline.