Axios npm Compromise Install-Time Postinstall Execution

Daniel Jeremiah@daniyyell

•updated Apr 8, 2026•13•0•282

Detects install-time execution context consistent with the Axios npm supply chain compromise. This rule looks for 'node setup.js' launched from within 'node_modules/plain-crypto-js' or related npm install working directories, or for npm install commands involving 'axios' or 'plain-crypto-js'.