details of the social engineering attack that led to the axios compromise: https://github.com/axios/axios/issues/10636#issuecomment-4180237789

That's actually terrifying how someone who is so deep in the industry can fall for it so it's probably very elaborate. I'm going to guess this is going to become more and more common with the help of AI. This comment goes further too.

Yeah, I can think of a few things that would’ve fixed this: 1. better credential management 2. better identity verification 3. better malware detection all of them are probably going to be increasingly important.

That github thread is very insightful, especially tayvano's posts. It's hard to really understand the maliciousness, dedication and persistence of threat actors, until you're the one being targeted. People have no idea of the extent it can reach. I think the debug/chalk compromise months ago really opened a pandora's box, and now there's no going back.