Axios npm Breach via Social Engineering

Axios HTTP library compromised when attackers used social engineering to access maintainer's npm account, publishing malicious versions 1.14.1 and 0.30.4 with trojan. Google linked attack to North Korean group UNC1069.

Cybersecurity Threats and Updates Summary

Multiple cybersecurity incidents reported including BITTER APT spyware, critical Axios and Marimo vulnerabilities, Nginx security updates, FBI dismantling W3LL phishing network with $20M fraud attempts, and Mozilla criticizing Microsoft's Copilot installation practices.

OpenAI: Axios Breach Didn't Compromise Data

OpenAI confirmed no user data was compromised in a North Korea-linked attack on developer tool Axios, which affected macOS app-signing workflows. The company is revoking certificates and requiring app updates.