Supply Chain Attack Targets Popular npm Package Axios

A significant supply chain attack has targeted the npm package axios, according to Foresight News. The latest version, [email protected], has been compromised with a malicious package, [email protected], which was previously nonexistent. This package has been confirmed as malware by Socket AI's analysis. Axios, which has a weekly download rate exceeding 100 million, poses a potential risk to all projects that have updated to the latest version. Feross, the founder of Socket AI, advises all axios users to immediately lock their current version and review their lock files, avoiding any upgrades to the latest version.