Chinese Tech Daily — 2026-04-09#
Top Story#
The “Hollywood-Style” Heist That Poisoned Axios
An elaborate, highly targeted social engineering attack compromised axios, one of the world’s most popular JavaScript libraries, downloaded nearly 100 million times a week. Attackers posed as a startup founder, set up a fake Slack workspace complete with marketing materials, and even hosted a live Microsoft Teams meeting with the lead maintainer to deploy a remote access trojan (RAT) disguised as a software update. This sophisticated heist underscores the escalating threat landscape for open-source maintainers, proving that even the most heavily scrutinized repositories are vulnerable to dedicated human exploits.