According to Huoxun Finance, attackers stole the npm access token of the lead maintainer of Axios, the most popular HTTP client library for JavaScript. Using this token, they released two malicious versions (axios@1.14.1 and axios@0.3.4) containing cross-platform remote access trojans (RATs), targeting macOS, Windows, and Linux systems. The malicious packages were removed from the npm registry after surviving for approximately three hours. Axios is downloaded over 100 million times weekly and exists in approximately 80% of cloud and code environments. Security companies detected the first infections 89 seconds after the malicious packages went live, and at least 135 systems were confirmed to have been compromised within the exposure window. Notably, the Axios project had previously deployed modern security measures such as the OIDC trusted release mechanism and SLSA provenance authentication, but the attackers completely bypassed these defenses. The investigation revealed that while configuring OIDC, the project also retained the traditional, long-term valid NPM_TOKEN. npm, when both coexist, prioritizes the traditional token by default, allowing attackers to complete the release without breaching OIDC.

According to Huoxun Finance, Uniswap founder Hayden Adams posted on the X platform that, despite the potential accusations of gloating, centralized projects must be prevented from calling themselves DeFi. He pointed out that if a project has an administrator key that can clear all funds, it belongs to CeFi; without this distinction, DeFi loses its meaning and its brand will be damaged. Furthermore, no version of Uniswap contains an administrator key that can clear funds.

Huoxun Finance reports that decentralized futures trading platform SunX will host a live stream today at 8 PM (UTC+8) titled "Crude Oil, Gold, BTC: Which is the Real Safe-Haven Asset?". Crypto KOLs such as Mr.Ice Fire, Zhengrongshuo, BitQi, Crypto Monkey Uncle, and Qiurong will participate, engaging in in-depth discussions on asset allocation logic against the backdrop of escalating global macroeconomic uncertainty. The stream will focus on analyzing the traditional safe-haven attributes of crude oil and gold, the evolution of Bitcoin's "digital gold" narrative, and the differences and dynamics among the three asset classes in terms of liquidity, volatility, and risk hedging.

According to Gate.com data, XAUUSD (gold) has fallen below 4600 USD and is currently trading at 4599.97 USD, with the daily decline widening to 3.26%.

According to Iran's Tasnim News Agency, an Iranian military spokesperson stated that a larger, wider, and more destructive attack is imminent. The war will continue until "the enemy surrenders and permanently regrets it." (Jin Shi)