The popular npm package axios has been compromised in a supply chain attack, with version 1.14.1 containing malicious code. Yu Xian, founder of SlowMist, relayed a warning from Feross, founder of Socket AI, highlighting that the package has been injected with the malware plain-crypto-js@4.2.1. This development poses a significant risk to projects using axios, which sees over 100 million weekly downloads. Socket AI's analysis confirmed the presence of the malware, prompting Feross to advise developers to pin their axios versions and review lock files to prevent potential security breaches. Users are urged to avoid upgrading to the affected version to mitigate risks.