npm supply chain

The compromise of Axios, one of the JavaScript ecosystem’s most widely used HTTP clients, is a reminder that the biggest software supply-chain threats often begin with the smallest human mistake. In this case, the malicious packages were not slipped in through a novel exploit in npm itself, but...