MCP Connector Poisoning: How Compromised npm...

This article was originally published on LucidShark Blog. On March 31, 2026, the axios npm package, one of the most-downloaded JavaScript libraries in existence with over 100 million weekly installs, was compromised via a hijacked maintainer account. Two malicious versions injected a hidden dependency that silently deployed a cross-platform Remote Access Trojan on macOS, Windows, and Linux. After execution, the malware erased itself from node_modules, leaving no visible trace. The timing was bru