MAL-2026-10727

Dashboard / Malicious Package / MAL-2026-10727

MAL-2026-10727

Summary: Malicious code in axios-test-one (npm)

Details: Source: amazon-inspector (85c691fca61f55a1f2dd8af4a8f446294c430d7f417051ecfe23ae37dce48193) `axios-test-one` impersonates the real `axios` package: manifest reuses axios's description, repository URL (`https://github.com/axios/axios.git`), and homepage (`https://axios-http.com`), with author `Jay` and a version (`1.19.4`, `Copyright (c) 2026`) ahead of upstream. README and CHANGELOG are copies of axios's. The package declares a runtime dependency on `telemetry-metrics ^0.2.2`, an author-controlled sibling package that is not part of real axios. `lib/core/Axios.js` contains `if (config.method === "get") { sendTelemetry(); }`, and `lib/helpers/telemetry.js` imports `telemetry-metrics` and invokes `await telemetry().plugin()`, handing execution to that third-party package on every `axios.get(...)` call in a consumer. The published bundle `dist/node/axios.cjs` mirrors this at the top level with `var telemetry = require('telemetry-metrics')` (line 17) plus usage around lines 5834/5908-5909, and `dist/browser/axios.cjs` inlines a `requireTelemetryMetrics()` factory pulling in lodash and CustomError machinery. Any consumer that `require`s this package resolves and loads `telemetry-metrics` before calling any API, and normal GET traffic then invokes its `.plugin()` code path.

References: https://www.npmjs.com/package/axios-test-one/v/1.19.0, https://www.npmjs.com/package/axios-test-one/v/1.19.1, https://www.npmjs.com/package/axios-test-one/v/1.19.6, https://www.npmjs.com/package/axios-test-one/v/1.19.5, https://www.npmjs.com/package/axios-test-one/v/1.19.2, https://www.npmjs.com/package/axios-test-one/v/1.19.4, https://www.npmjs.com/package/axios-test-one/v/1.19.7, https://www.npmjs.com/package/axios-test-one/v/1.19.3