Resecurity describes a malicious npm supply-chain campaign in which plain-crypto-js was embedded as a dependency in compromised Axios versions and executed through npm's postinstall lifecycle hook. The Node.js dropper used layered obfuscation, including string reversal, Base64 normalization, and XOR decryption with the key OrDeR_7077, to hide modules, commands, OS-specific payloads, and the C2 URL. The malware targeted Windows, macOS, and Linux systems, contacted http://sfrclak.com:8000/, and attempted credential theft involving npm tokens, AWS keys, SSH keys, and CI/CD secrets. The infection path matters because developers could be compromised by installing Axios normally, allowing a transitive dependency to execute payloads without direct user interaction.