Unit42 reported that the popular Axios JavaScript library was altered in the npm registry, inserting malicious code that runs during build processes and extracts API keys and credentials from applications that depend on the library.

The malicious payload was executed in downstream projects, allowing threat actors to harvest credentials from thousands of applications that incorporated the compromised package, creating a broad avenue for credential theft and potential lateral movement.

Defenders should enforce strict provenance verification and continuously monitor third‑party open‑source dependencies to detect unauthorized changes before they are integrated.