Gate News: On March 31,, Socket AI issued a security alert stating that the core dependency package axios in the npm ecosystem has been targeted in an active supply chain attack. Its latest version, axios@1.14.1, was injected with a previously unseen malicious package, plain-crypto-js@4.2.1. Socket AI's analysis confirmed that this package is malicious software. axios is downloaded over 100 million times weekly, and all projects updating to the latest version are at potential risk of compromise. Socket AI founder Feross recommends all axios users immediately lock their versions and review their lock files, and avoid upgrading to the latest version.