Widely-Used axios Library Compromised in Major npm Supply Chain Attack

With 100 million weekly downloads, axios is one of JavaScript's most critical HTTP libraries, making its compromise through an npm supply chain attack a major threat to frontend applications, backend services, and enterprise systems worldwide. Attackers exploited a hijacked npm token to publish malicious versions containing a multi-stage remote access trojan capable of executing arbitrary commands and exfiltrating sensitive data and environment secrets. Developers who installed affected versions (1.14.1 and 0.30.4) must immediately treat their machines as compromised and rotate all credentials to prevent unauthorized access.