Hello. A breach Tuesday of the widely used Axios software library is the latest in a string of incidents exposing risks in the systems that underpin how modern software is built.

Developers use Axios to handle how data moves between services, and the open-source tool is downloaded tens of millions of times a week. The real developers detected and contained the malicious update within hours, but the incident demonstrates how a single compromise can ripple across many organizations. Read our explainer.

Also today: 

• Hasbro warns of potential delays in ordering, delivery after hack
• Anthropic races to contain source-code leak
• Stryker says operations are restored after March 11 cyberattack
• Russia launches super app to rival China's WeChat
• And more

Medical-device maker Stryker said Wednesday manufacturing operations “are fully operational” three weeks after a March 11 cyberattack disrupted global order processing, manufacturing and shipping. Pro-Iran hackers claimed responsibility for the attack, which wiped data from some employees’ mobile devices and laptops.

The Kremlin enters the chat with Russia’s new super-app, named Max. Moscow wants to emulate China’s WeChat by having a one-stop app to dominate the internet and lock Western rivals out. Max is a messaging and e-commerce platform run by tech giant VK that is expanding to offer everything from taxi-hailing services to electronic passport wallets. (WSJ)

• Data-privacy activists say that the unencrypted new app is the tip of the spear in a growing censorship apparatus that will allow the Kremlin to see and hear everything its citizens do online.
• The White House last week launched its own app, offering news, live streams of Washington events and access to an Immigrations and Customs Enforcement tip line.

An Italian tech company fooled around 200 people mainly in Italy into downloading what they thought was the WhatsApp messaging app, Meta said. ASIGINT, a unit of Italian cyber intelligence firm SIO, created an app to look like WhatsApp but install spyware, Meta said. (Reuters)

Ransomware detector: Google said its Google Drive platform will now include a ransomware detection feature turned on by default. If ransomware is found, an alert will go to users and tech staff and file syncing will be paused until the situation is resolved. (Bleeping Computer)

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.