Axios Compromise: What Actually Happened

Axios 1.3.2 is a supply chain implant, not a software vulnerability. The distinction matters operationally. There is no CVE because no code in the library was defective - an attacker with valid npm credentials published a trojaned release, and it remained live in the registry for approximately 78 hours before a community security researcher flagged the anomalous publish and npm's security team pulled the release. At 100M+ weekly downloads, the exposure window was not trivial. The payload mechani