The malicious axios versions were downloaded around 100 million times weekly, raising alarms across the software development community. As axios is a critical library that enables applications to make HTTP/S requests, the impact of this breach was particularly severe, affecting approximately 80% of cloud and code environments that utilize the library. The malicious package contained a dropper that downloaded and executed platform-specific payloads, functioning as lightweight remote access trojans (RATs).

Key moments

Security experts reported that the malicious versions of axios were live for a short window, yet they managed to reach a significant impact radius across web applications, services, and pipelines. The attack was sophisticated, involving a pre-staged decoy package designed to appear legitimate, which further complicated detection efforts. Observations indicated that around 3% of affected environments executed the malicious payloads, with beacons communicating with a command-and-control (C2) server every 60 seconds.

In light of the breach, organizations are strongly advised to audit their environments for potential execution of these malicious versions. The ramifications of this attack extend beyond immediate security concerns; experts warn that the attacker may have gained access to repository secrets, including signing keys and API keys, which could be leveraged for future backdoor attacks on applications and their users.

Axios has been a staple in the JavaScript ecosystem, often included as a transitive dependency across millions of applications. This compromise is particularly significant due to the library’s extensive usage, making it a prime target for malicious actors. Any post-infection inspection of the node_modules/plain-crypto-js/package.json file would reveal a clean manifest, further complicating the detection of the trojanized package.

As the dust settles from this incident, the software development community is left grappling with the implications of such a breach. The swift action taken to remove the malicious versions from npm highlights the importance of vigilance in software supply chain security. However, the sheer volume of downloads and the rapid spread of the compromised versions underscore the challenges faced in safeguarding widely-used libraries.

In the wake of this incident, the axios community and security experts are calling for enhanced security measures to protect maintainers and their accounts. This includes implementing multi-factor authentication and regular audits of package dependencies to prevent similar occurrences in the future. The incident serves as a stark reminder of the vulnerabilities inherent in software development and the need for continuous monitoring and improvement of security practices.

The post Axios Maintainer Account Compromised: Malicious Versions Released appeared first on DG News Sport.

Oracle is cutting thousands of jobs as part of a broader organizational change, a move that comes as the company grapples with a 25% drop in its stock price this year. As of May 2025, Oracle employed 162,000 people, but this significant reduction is expected to impact various departments, including Oracle Health, Sales, Cloud, Customer Success, and NetSuite.

In a notification email sent to affected employees, Oracle stated, “After careful consideration of Oracle’s current business needs, we have made the decision to eliminate your role as part of a broader organizational change.” This decision reflects the company’s urgent need to adapt to a rapidly evolving market landscape, particularly with the rising competitive threat posed by generative artificial intelligence models.

Oracle’s strategy involves raising $50 billion in debt and equity to fund its AI infrastructure buildout, a move that has raised eyebrows among investors concerned about the company’s growing debt levels and dwindling cash flow. This financial maneuvering is indicative of the broader pressures facing tech giants as they pivot towards AI capabilities.

Notably, Oracle is not alone in this trend. Earlier this year, Amazon announced it would cut about 16,000 corporate roles, highlighting the ongoing shifts within the tech industry as companies streamline operations in response to market demands.

As Oracle navigates this tumultuous period, observers are closely watching how these layoffs will affect its operational efficiency and market position. The company’s core business is under scrutiny as it faces increasing competition from rivals like Meta and other tech leaders who are also investing heavily in AI.

Details remain unconfirmed regarding the exact number of layoffs and the specific departments affected, but the implications of this organizational shift are already being felt across the industry. The tech landscape is rapidly changing, and Oracle’s response will be critical in determining its future trajectory.

The post Oracle Announces Major Layoffs Amidst AI Investment Strategy appeared first on DG News Sport.