MAL-2026-14029

    Dashboard / Malicious Package / MAL-2026-14029

    MAL-2026-14029

    Published: 14 Aug 2026Last Modified: 14 Aug 2026

    Summary: Malicious code in axios-fast (npm)

    Details: Source: amazon-inspector (9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e) [email protected] declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire process.env of the installing machine to a hardcoded webhook.site inbox (https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/). The script fires automatically on npm install, before any code is reviewed, and dumps all environment variables — routinely including AWS_*, NPM_TOKEN, GH_TOKEN, and other CI/build secrets — to a third-party attacker-controlled endpoint. The package name typosquats the popular axios HTTP client but its shipped functionality is limited to this install-time exfiltration.

    References: https://www.npmjs.com/package/axios-fast/v/1.0.0, https://www.npmjs.com/package/axios-fast/v/1.0.1

    Affected packages

    Package

    Name: axios-fast

    Purl: pkg:npm/axios-fast

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1
    MAL-2026-14029 | CVE-DB