Up to four npm packages on Axios were replaced with malicious versions, in one of the most sophisticated supply chain attacks.