Wu Shuo learned that, according to security researcher Feross and the SlowMist team, one of the most commonly used dependency packages in the npm ecosystem, axios, has suffered a serious supply chain attack. The attacker released malicious versions axios@1.14.1 and axios@0.30.4. These versions automatically include malicious loaders that decrypt and execute shell commands at runtime, implanting malicious payloads into the operating system (covering macOS, Linux, and Windows) and possessing anti-forensics capabilities to erase traces. With over 100 million downloads per week, the impact is significant. SlowMist advises developers to immediately fix the dependency versions, avoid upgrading, and check whether their local environment has been compromised.