Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Malicious versions of axios (1.14.1 and 0.30.4) were published to npm after an attacker compromised a maintainer's credentials and changed the account email. Both versions inject a fake dependency (plain-crypto-js) that executes a cross-platform remote access trojan dropper on install, then self-deletes to evade detection. Any developer using these specific versions in the attack window should check for infection and upgrade immediately.