Attackers stole a long-lived npm access token belonging to the lead maintainer of axios, the most popular HTTP client library in JavaScript, and used it to publish two poisoned versions that install a ...
Claude Opus commit added malicious npm dependency in Feb 2026, enabling crypto theft and persistent RAT access.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results