Click here to view full gallery at Hypebeast

JPMorgan Chase chairman and CEO Jamie Dimon told "The Axios Show" that while the ongoing Iran war involves some "short-term risks" for the economy, the country's regime has been a malign actor since its inception.

• "Having those folks, their [grip] on the Strait of Hormuz and funding all these proxy wars — why the Western world put up with these proxy wars for 45 years is kind of beyond me," Dimon told Axios CEO Jim VandeHei.

Why it matters: Those are strikingly hawkish comments from the leader of America's largest bank, making him one of the corporate world's most prominent defenders of a war that currently appears politically unpopular and economically damaging.

What he's saying: Dimon said critics who argue there was "no imminent threat" from Iran are simply saying "the bad thing hasn't happened" yet.

• "They've been killing people around the world for 45-plus years. They've killed a lot of Americans. They've funded Hamas, Hezbollah, the Houthis ... they have terrorist cells here," Dimon told Axios from his bank's new global headquarters at 270 Park Ave. in Manhattan.

Dimon said Iran "never gave up on nuclear" and had shown it had ballistic missiles with a range of nearly 3,000 miles.

• "They were bad," Dimon said of the Iranian regime, which remains in place despite the assassination of its supreme leader and many of his lieutenants.

The flip side: "Does it create all this uncertainty? Absolutely," he continued. "Does it create more short-term risk for oil prices? Absolutely. I'm praying it ends well."

• "I literally hope it turns out well and that somehow we get peace in the Middle East permanently," Dimon said.

The bottom line: Dimon argued that a successful outcome neutralizing the threat from Tehran would ultimately outweigh the current market turmoil — while acknowledging that outcome is far from certain.

Go deeper: Trump attacks allies, signals Iran war may end without opening Hormuz.

Suspected North Korean hackers are believed to be behind an ongoing compromise of the widely used open-source package Axios, which is downloaded millions of times per week, researchers at Google said Tuesday.

Why it matters: Hackers briefly turned a widely trusted developer tool into a vehicle for credential-stealing malware that could give attackers ongoing access to infected systems.

• Axios, a widely used JavaScript library for making HTTP requests, is not affiliated with Axios Media.

Driving the news: Researchers at Google linked the activity to a North Korean group tracked as UNC1069, which has previously targeted cryptocurrency and decentralized finance companies.

• Earlier this week, a maintainer account for the Axios npm package was compromised, allowing attackers to publish malicious versions of the software targeting macOS, Windows and Linux systems.
• The attackers published at least two malicious versions of the package before they were discovered and removed.

Threat level: The malicious versions were removed within roughly three hours of being published, but Google warned the incident could have "far-reaching impacts" given the package's widespread use, according to John Hultquist, chief analyst at Google Threat Intelligence Group.

• Wiz estimates Axios is downloaded roughly 100 million times per week and is present in about 80% of cloud and code environments.
• So far, Wiz has observed the malicious versions in roughly 3% of the environments it has scanned.

Between the lines: Google researchers said the incident is separate from another major npm supply chain attack disclosed last week.

What to watch: It remains unclear how the attackers gained access to the maintainer's GitHub account.

• Supply chain compromises often have a long tail, as infected code can persist in downstream projects long after malicious packages are removed.

Go deeper: Why organizations struggle to fend off supply chain cyberattacks