PSA: axios 1.14.1 and 0.30.4 are compromised — open-source scanner detects the plain-crypto-js backdoor