Inside the Axios supply chain compromise - one RAT to rule them all

Reported 01 Apr 2026 by otx · Severity: medium

Elastic Security Labs identified a supply chain compromise of the axios npm package, one of the most depended-upon packages in the JavaScript ecosystem with approximately 100 million weekly downloads. The attacker compromised a maintainer account and published backdoored versions