Post

Socket
@socket.dev

🚨 Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today. We're still investigating. If you use axios, pin your version and audit your lockfile. socket.dev/blog/axios-n...

socket.devSupply Chain Attack on Axios Pulls Malicious Dependency from...A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHu...

68 reposts98 likes

Marc Bernard
@marcf.be

“…the attack delivered a full-featured Remote Access Trojan with the ability to execute arbitrary commands, inject additional binaries, and enumerate the victim's filesystem.” Thanks for the warning and detailed analysis 🙏 These attacks are DANGEROUS ☣️