Axios npm package compromised in supply chain attack. Downloads malware dropper package

Axios npm package compromised in supply chain attack. Downloads malware dropper package
嗯，用户让我帮忙总结一下这篇文章的内容，控制在一百个字以内。首先，我需要仔细阅读文章内容，抓住关键点。文章主要讲的是Axios这个npm包被供应链攻击了。恶意版本1.14.1和0.30.4昨天出现在npm仓库里，带了一个恶意软件dropper叫[email protected]。建议用户检查lockfile，回滚到1.14.0版本，并且轮换所有凭证。现在npm已经移除了这些受损版本和恶意包。接下来，我需要把这些信息浓缩到一百字以内。直接描述事件，不使用总结性的开头。确保包含关键点：Axios被攻击、恶意版本、携带恶意软件、建议措施、npm已处理。可能的结构是：Axios遭受供应链攻击，发布恶意版本，包含恶意软件，建议回滚和轮换凭证，npm已移除受损包。检查字数是否在限制内，确保信息准确无误。 </think> Axios遭遇供应链攻击，发布恶意版本1.14.1和0.30.4，携带恶意软件[email protected]。建议检查lockfile并回滚至安全版本1.14.0，同时轮换环境凭证。目前npm已移除受损包及恶意crypto js包。 2026-3-31 05:9:55 Author: www.reddit.com(查看原文) 阅读量:5 收藏

Axios is one of the most used npm packages which just got hit by a supply chain attack. Malicious versions of Axios (1.14.1 and 0.30.4) hit the npm registry yesterday. They carry a malware dropper called [email protected]. If you ran npm install in the last 24 hours, check your lockfile. Roll back to 1.14.0 and rotate every credential that was in your environment. Currently, as of now, npmjs has removed the compromised versions of axios package along with the malicious plain crypto js package. Live updates + info linked.

文章来源: https://www.reddit.com/r/netsec/comments/1s8e9yk/axios_npm_package_compromised_in_supply_chain/
如有侵权请联系:admin#unsafe.sh