A hacker inserted malware in Axios, an open source web tool downloaded tens of millions of times weekly, in a widespread hack.