Ryan rymalia

Axios npm Supply Chain Compromise — Full Analysis Package

Date: 2026-03-31 | Attribution: BlueNoroff / Lazarus Group (HIGH confidence) Attack: Maintainer account hijacked, cross-platform RAT deployed via axios@1.14.1 and axios@0.30.4

What happened

On March 30-31, 2026, the npm package axios (~83M weekly downloads) was compromised through a maintainer account hijack. Two malicious versions injected plain-crypto-js@4.2.1, an obfuscated dropper that deploys platform-specific RATs (Windows PowerShell, macOS Mach-O C++, Linux Python). The macOS RAT is classified as NukeSped (Lazarus-exclusive). The internal project name macWebT links directly to BlueNoroff's documented RustBucket webT module from 2023.

File Index

name	create-pr
description	This skill should be used when the user asks to "create a PR", "open a pull request", "make a PR", "submit a PR", "push a PR", or any variation of creating/opening a pull request. The skill focuses on extracting the INTENT behind changes and creating meaningful PR descriptions.
allowed-tools	Bash Read Write Grep Glob AskUserQuestion

Pull Request Creation

name	codex
description	Use OpenAI Codex CLI for complex debugging, code analysis, or when stuck on difficult problems. Invokes Codex with a file-based question/answer pattern.
disable-model-invocation	true

Using Codex for Complex Debugging

When you encounter a difficult problem that would benefit from a second perspective or deep analysis, use Codex via the file-based pattern.

name	orchestrating-swarms
description	Master multi-agent orchestration using Claude Code's TeammateTool and Task system. Use when coordinating multiple agents, running parallel code reviews, creating pipeline workflows with dependencies, building self-organizing task queues, or any task benefiting from divide-and-conquer patterns.

Claude Code Swarm Orchestration

Master multi-agent orchestration using Claude Code's TeammateTool and Task system.

Claude Code TeammateTool - Source Code Analysis

This is not a proposal. This documents existing but hidden functionality found in Claude Code v2.1.19 binary, plus speculation on how it could be used.

Executive Summary

TeammateTool already exists in Claude Code. We extracted this from the compiled binary at ~/.local/share/claude/versions/2.1.19 using strings analysis. The feature is fully implemented but gated behind feature flags (I9() && qFB()).

Create a production-ready, visually stunning website with a futuristic luxury travel theme.

GOAL Build a single-page (plus optional “Destination” detail route) website for a fictional brand: “AURORA LUXE TRAVEL” — ultra-premium, concierge-level trips.

TECH STACK (use exactly this unless something breaks)

Next.js (latest stable) + TypeScript
Tailwind CSS
Framer Motion (for scroll/entrance animations)

name

plant-seed

Plant Seed Command

Plant ideas you want to tend - instant capture from context, with optional enrichment.

description

Interview me about the plan

argument-hint

plan

model

opus

Read this plan file $1 and interview me in detail using the AskUserQuestionTool about literally anything: technical implementation, UI & UX, concerns, tradeoffs, etc. but make sure the questions are not obvious.

	# /// script
	# requires-python = ">=3.12"
	# dependencies = [
	# "parakeet-mlx",
	# "sounddevice",
	# "rich",
	# ]
	# ///
	import queue


	"""
	a simple script that reads tweets inside a json file, uses openai to compute embeddings and creates two files, metadata.tsv and output.tsv, which cam be used to visualise the tweets and their embeddings in TensorFlow Projector (https://projector.tensorflow.org/)
	"""

	# obtain tweets.json from https://gist.github.com/gd3kr/948296cf675469f5028911f8eb276dbc

	import pandas as pd
	import json
	from openai import OpenAI