Threat actors have compromised a popular npm package, axios, by hijacking the account of one of its open-source maintainers, allowing them to spread Remote Access Trojans (RATs) malware. The axios package is widely used in web development, making it an attractive target for attackers. By gaining control of the package, attackers can inject malicious code into the software supply chain, potentially affecting numerous downstream applications. This type of attack highlights the risks associated with relying on open-source software and the importance of verifying the integrity of dependencies. The incident underscores the need for developers to be vigilant about the security of their dependencies and to implement robust security measures to prevent similar attacks1. This matters to practitioners because a single compromised package can have far-reaching consequences, making it essential to stay informed about potential vulnerabilities in the software supply chain.