axios-test-one

{"schema_version":"1.7.4","id":"MAL-2026-10727","published":"2026-07-16T18:45:35Z","modified":"2026-08-19T02:32:56.053784073Z","summary":"Malicious code in axios-test-one (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (85c691fca61f55a1f2dd8af4a8f446294c430d7f417051ecfe23ae37dce48193)\n`axios-test-one` impersonates the real `axios` package: manifest reuses axios's description, repository URL (`https://github.com/axios/axios.git`), and homepage (`https://axios-http.com`), with author `Jay` and a version (`1.19.4`, `Copyright (c) 2026`) ahead of upstream. README and CHANGELOG are copies of axios's. The package declares a runtime dependency on `telemetry-metrics ^0.2.2`, an author-controlled sibling package that is not part of real axios. `lib/core/Axios.js` contains `if (config.method === \"get\") { sendTelemetry(); }`, and `lib/helpers/telemetry.js` imports `telemetry-metrics` and invokes `await telemetry().plugin()`, handing execution to that third-party package on every `axios.get(...)` call in a consumer. The published bundle `dist/node/axios.cjs` mirrors this at the top level with `var telemetry = require('telemetry-metrics')` (line 17) plus usage around lines 5834/5908-5909, and `dist/browser/axios.cjs` inlines a `requireTelemetryMetrics()` factory pulling in lodash and CustomError machinery. Any consumer that `require`s this package resolves and loads `telemetry-metrics` before calling any API, and normal GET traffic then invokes its `.plugin()` code path.\n","affected":[{"package":{"name":"axios-test-one","ecosystem":"npm"},"versions":["1.19.0","1.19.1","1.19.6","1.19.5","1.19.2","1.19.4","1.19.7","1.19.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/helpers/telemetry.js","sha256":"16fd2ae8bc57e00c0f39dca2b9ccd20449250d443103117dbaf3bfdba3a0908d","tlsh":"f9b01282234255c90c70fbbb463b0411933aceb41d04634190404373041d40cf1c1c2c"},{"path":"package.json","sha256":"80f9e324c4d7bb815534d90fae87f64f22fed2effcede518d4f7b93f370a30a4","tlsh":"7dd1db62c89a4d572fe439acac9b5555a231804fcc41fa08736e428d4f4d72f32fb66e"}],"package_integrity":[{"filename":"axios-test-one-1.19.0.tgz","hashes":{"sha1":"b0bf5c2f84d8bc1fd3f724f15704ce2461853c92","sha512_sri":"sha512-RExEvU07uhqy1eWiT3T3sCZye5q8mKO3fhfP6H1TOcfv48iO0g5TlnZ5fHR4KCay/wo/WjSZ4lmGojBW14dSOA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-test-one/v/1.19.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-test-one/v/1.19.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-test-one/v/1.19.6"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-test-one/v/1.19.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-test-one/v/1.19.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-test-one/v/1.19.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-test-one/v/1.19.7"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-test-one/v/1.19.3"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010773","import_time":"2026-07-16T18:54:04.018937255Z","modified_time":"2026-07-16T18:45:35Z","sha256":"5f53cd512e7aa0549f6ff4ae3064dc13fd8d72c8dddc464f7639376abfadc4a6","source":"amazon-inspector","versions":["1.19.0"]},{"id":"IN-MAL-2026-018285","import_time":"2026-08-19T02:31:08.264226815Z","modified_time":"2026-08-19T01:59:11Z","sha256":"2481aaca0a26e487bee4ad7ac8c1f9b87d52c30fe21d9ed9ff0e7bb482db9534","source":"amazon-inspector","versions":["1.19.1"]},{"id":"IN-MAL-2026-018284","import_time":"2026-08-19T02:31:08.188347608Z","modified_time":"2026-08-19T01:59:05Z","sha256":"2b7412a87f5e47fb7f3a708b51b24902fafe789e73e6f2095c5ee74c785c6ed2","source":"amazon-inspector","versions":["1.19.6"]},{"id":"IN-MAL-2026-018283","import_time":"2026-08-19T02:31:08.110373005Z","modified_time":"2026-08-19T01:58:55Z","sha256":"45f0d9827fe696432460a45fb65195e725fe6064c531cdb3a9088802f9e75afa","source":"amazon-inspector","versions":["1.19.5"]},{"id":"IN-MAL-2026-018281","import_time":"2026-08-19T02:31:07.929695162Z","modified_time":"2026-08-19T01:58:39Z","sha256":"5853eed6bf9f20a9efa506a222b4e8a0224f72e6ac4108b0bfdf285a9a617659","source":"amazon-inspector","versions":["1.19.2"]},{"id":"IN-MAL-2026-018282","import_time":"2026-08-19T02:31:08.018469831Z","modified_time":"2026-08-19T01:58:47Z","sha256":"85c691fca61f55a1f2dd8af4a8f446294c430d7f417051ecfe23ae37dce48193","source":"amazon-inspector","versions":["1.19.4"]},{"id":"IN-MAL-2026-018288","import_time":"2026-08-19T02:31:08.527487274Z","modified_time":"2026-08-19T01:59:34Z","sha256":"92ef19e466cb6036e09b3acbe0ac6b4dced7f74fb261681bbed8b286776ffd31","source":"amazon-inspector","versions":["1.19.7"]},{"id":"IN-MAL-2026-018286","import_time":"2026-08-19T02:31:08.337140594Z","modified_time":"2026-08-19T01:59:19Z","sha256":"abc28482372ce03b07ed96182a16a1c4b572bddd6e91ad8a816b45d53d335da3","source":"amazon-inspector","versions":["1.19.3"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}