Mar 31, 2026Axios npm Supply Chain Attack: Malicious Versions Drop Remote Access TrojanTwo poisoned releases of axios — one of the most widely-used Node.js HTTP client libraries — were published and pulled from npm within hours. Here's what happened, how the attack worked, and what you need to do right now.
