axios npm package hit by supply-chain attack; malicious code found in v1.14.1

ME News reported that on March 31 (UTC+8), Yu Xian, founder of SlowMist, relayed an alert from Feross, founder of Socket AI, warning that axios—a core dependency in the npm ecosystem—is facing an active supply-chain attack. The latest release, axios@1.14.1, was reportedly injected with a previously unseen package, plaincryptojs@4.2.1. Socket AI’s analysis has identified plaincryptojs@4.2.1 as malware. With axios seeing more than 100 million weekly downloads, any project that pulls the latest version may be exposed to compromise. Feross urged axios users to pin their current versions immediately, audit their lock files, and avoid upgrading to the latest release. (Source: Foresight News)