An attacker compromised the npm account of a lead Axios maintainer on March 30, and used it to publish two malicious versions of the widely used JavaScript HTTP client library.

Up to four npm packages on Axios were replaced with malicious versions, in one of the most sophisticated supply chain attacks.

An experimental Rust compiler is intended to replace the previous Go compiler, and the Astro dev server now supports custom runtimes.