Openjs Security Working Group

Two malicious Axios releases were briefly published on npm due to a compromised maintainer account, introducing a remote-access trojan via plain-crypto-js; remediation focuses on OIDC-based publishing, immutable releases, CI publishing, and credential hygiene.