A poisoned axios package has been found to spread cross-platform malware via a phantom dependency. The compromised package is a popular javascript library with a large number of downloads, reportedly over 100 million weekly downloads. The extent of the impact is being assessed, with some reports indicating a widespread effect from the supply chain attack.