Axios Has 100 Million Weekly Downloads. North Korea Backdoored It in 39 Minutes. — mistaike

On March 31, a North Korea-linked threat actor hijacked the Axios npm maintainer account and published two backdoored versions within 39 minutes. The cross-platform RAT payload targeted every OS. Axios sits underneath virtually every AI agent framework, MCP client, and workflow automation tool in production today.