Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account
2026-03-31T07:24:06Z•698f174d18385f132b349943c702f39438494e0fe13dcd2d742bb956d85b4c70
PyPIactive-exploitationchatgptcitrixcredential-theftcve-2025-53521cve-2026-3055darksworddata-exfiltrationdeeploadf5genielockerios-exploitlangchainlanggraphllm-securitymalicious-dependencymalwarenpmopenairansomwaresupply-chainta446vulnerabilityzero-click-xss','claude-extension','open-vsx','aitm-phishing','t
What happened
A batch of high-impact security events: a supply-chain compromise of the popular Axios npm package (malicious "plain-crypto-js" dependency published from a compromised account), and multiple other supply-chain attacks (malicious Telnyx PyPI releases, Open VSX vetting bypass). Critical/exploited vulnerabilities are being actively probed and added to KEV (Citrix NetScaler CVE-2026-3055 under active recon; F5 BIG-IP APM CVE-2025-53521 added to CISA KEV). Significant malware and targeted campaigns were reported (DeepLoad loader using ClickFix social engineering and WMI persistence; Russian CTRL .L
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 698f174d18385f132b349943c702f39438494e0fe13dcd2d742bb956d85b4c70
- Enrichment time
- 2026-03-31T07:24:06Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.