Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver ...

2026年3月31日，两个恶意版本的流行JavaScript HTTP库Axios被短暂发布到npm仓库。这两个版本均包含隐藏依赖项，可在macOS、Windows和Linux系统上安装远程访问木马（RAT）。此次攻击并未利用Axios代码本身的漏洞 ...

Spread the loveIn a significant security incident that has sent shockwaves through the developer community, a North Korean state-sponsored hacking group has successfully compromised the popular Axios ...

A supply-chain attack backdoored versions of Axios, a popular JavaScript library that's present in many different software ...

On March 31, 2026, the popular HTTP client Axios experienced a supply chain attack, causing two newly published npm packages ...

Attackers stole a long-lived npm token from the lead axios maintainer and published two poisoned versions that drop a ...

An attacker compromised the npm account of a lead Axios maintainer on March 30, and used it to publish two malicious versions ...

Axios, a widely used JavaScript HTTP client, was briefly distributed through npm in two malicious versions after a maintainer ...

The widely used Axios HTTP client library, a JavaScript component used by developers, was recently hacked to distribute ...

开发者广泛使用的Axios HTTP客户端库这一JavaScript组件最近遭到黑客攻击，通过被入侵的账户分发恶意软件。

With almost 175,000 npm projects listing the library as a dependency, the attack had a huge cascade effect and shows how ...

The biggest story of the week is a new massive supply chain breach, which appears to be unrelated to the previous massive supply chain breaches, this time of the Axios HTTP project. Axios was ...