Mitigating the Axios npm supply chain compromise

Microsoft Security Blog (late March–early April 2026) highlights multiple high‑impact threats and mitigations: a March 31 Axios npm supply‑chain compromise—two malicious npm packages (now removed) that downloaded from C2 and attributed to North Korean actor Sapphire Sleet—potentially exposed hundreds to millions of users; guidance for detecting and responding to a Trivy distribution compromise that injected credential‑stealing malware into CI/CD pipelines worldwide; a WhatsApp‑delivered campaign using VBScript and cloud‑hosted payloads to install MSI backdoors; and additional advisories on the