OX Security analyzes a supply-chain compromise of axios versions 0.30.4 and 1.14.1 through the malicious [email protected] dependency. The dependency's postinstall setup.js script contacted sfrclak[.]com on port 8000, fingerprinted the operating system, and downloaded Windows, macOS, or Linux payloads. The macOS payload supported C2-driven AppleScript execution, the Linux Python variant beaconed with host, process, and filesystem telemetry, and the Windows PowerShell variant added autorun persistence through a hidden batch file and Run key. The report warns that affected machines should be treated as fully compromised because the RAT behavior could expose credentials, API keys, crypto wallets, and other sensitive data.