GHSA-fw8c-xr5c-95f9: Embedded Malicious Code via compromised maintainer account

Two malicious versions of the axios npm package (1.14.1 and 0.30.4) were published on March 31, 2026 using a compromised maintainer account. Both versions inject a hidden dependency (plain-crypto-js@4.2.1) that deploys a cross-platform remote access trojan targeting macOS, Windows, and Linux. The malicious postinstall script contacts a command-and-control server and downloads a platform-specific second-stage payload. Any system that ran npm install while either version was available should be treated as fully compromised. The malicious packages have been removed from the npm registry.