🕵️ Axios compromise

The items that name it 5

• Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
  article2026-10-30It is written here as Axios compromise (March 2026; malicious releases 1.14.1 and 0.30.4).

  March 2026; malicious releases 1.14.1 and 0.30.4

• Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain
  paper2026-10-20It is written here as Axios compromise (malicious package incident, cited as a recent incident).

  malicious package incident, cited as a recent incident

• Evolution of Web3 in Cloud Supply Chain Attacks
  article2026-10-07It is written here as Axios compromise (DPRK-affiliated; backdoored dependency plain-crypto-js).

  DPRK-affiliated; backdoored dependency plain-crypto-js

• The OpenSourceMalware Show #7
  talk2026-06-03

  Early 2026 (described as early April/late March timeframe) social-engineering-based account takeover targeting a specific individual (Jason); described as likely the last major example of a social-engineering-based entry point before the shift to machine/pipeline-based attacks

• VSCode Lifecycle Script Malware
  writeup2026-05-16

  Attackers compromised Axios and published two versions adding a new dependency, plain-crypto-js, whose postinstall hook fired setup.js, a heavily obfuscated multi-stage loader deploying platform-specific RATs for Windows, macOS, and Linux