Supply chain attack on Axios npm package: Scope, impact, and remediations

Tenable confirmed a software supply‑chain compromise of the popular Axios npm package: attackers hijacked a maintainer account and published malicious Axios releases (noted versions 1.14.1 and 0.30.4) that introduce a hidden malicious dependency called “plain-crypto-js.” Any environment that pulled those versions is at high risk of credential and API‑key theft and other severe data exfiltration. Immediate actions: scan for and identify hosts/artifacts containing the compromised versions or dependency (package.json, lockfiles, node_modules, SBOMs, artifact registry logs), quarantine affected bl