🦋 🚨 Active supply chain attack on axios@1.14.1.

[bloglab@mstdn.feddit.social]

Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today.

We're still investigating. If you use axios, pin your version and audit your lockfile. https://socket.dev/blog/axios-npm-package-compromised

https://bsky.app/profile/socket.dev/post/3mid7jgod6c2h

#Security #SupplyChain #Bluesky