axios

axios is identified in the SafeDep analysis "axios Compromised: npm Supply Chain Attack via Dependency Injection". axios 1.14.1 was published to npm via a compromised maintainer account, injecting a trojanized dependency that executes a multi-platform reverse shell on install. No source code changes in axios itself, just a new entry in package.json.