MAL-2026-14163

Dashboard / Malicious Package / MAL-2026-14163

MAL-2026-14163

Summary: Malicious code in axois-http (npm)

Details: Source: amazon-inspector (69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885) axois-http is a typosquat of axios (index.js exports an empty object). Its scripts/postinstall.js unconditionally POSTs a JSON body containing a detected-platform label (Windows/MacOS/Linux, with WSL detection via /proc/version and /proc/sys/kernel/osrelease) to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote at npm install time. On Windows or WSL, the script XOR-decodes a hidden URL (key 'stf2026', decoded prefix 'https://') and a XOR-decoded PowerShell launcher command, downloads a native binary to %TEMP%\main.exe via fetchAddonBinary, and spawns it detached with windowsHide:true and stdio:'ignore'. URL, PowerShell command, and surrounding bridge script fragments are stored as byte arrays and decoded at runtime via unpackSegment(data, 'stf2026') solely to hide the payload URL and shell command. The package has no legitimate need for a native binary and offers no first-party functionality.

References: https://www.npmjs.com/package/axois-http/v/1.0.0