axios-fast

{"schema_version":"1.7.4","id":"MAL-2026-14029","published":"2026-08-14T14:14:31Z","modified":"2026-08-14T15:23:42.844795032Z","summary":"Malicious code in axios-fast (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e)\naxios-fast@1.0.1 declares a preinstall lifecycle script in package.json that runs a Node one-liner which POSTs the entire process.env of the installing machine to a hardcoded webhook.site inbox (https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/). The script fires automatically on npm install, before any code is reviewed, and dumps all environment variables — routinely including AWS_*, NPM_TOKEN, GH_TOKEN, and other CI/build secrets — to a third-party attacker-controlled endpoint. The package name typosquats the popular axios HTTP client but its shipped functionality is limited to this install-time exfiltration.\n","affected":[{"package":{"name":"axios-fast","ecosystem":"npm"},"versions":["1.0.0","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"e98f61e671c3470741c48ce4438b7b1c18017a017ab617fa52bf098c0f696ec8","tlsh":"9ef00ca7e445b8331ac897204a22950bf2f08a6b000abc04b3c3053c5adc2ba15fd65d"}],"package_integrity":[{"filename":"axios-fast-1.0.0.tgz","hashes":{"sha1":"e943de4aa335d26fe74f920e27e3cf03361b460a","sha512_sri":"sha512-cICHx03WL6tdsiNkYFmvLtUcKq/V/l6Kdiqu6lvzdb50e27oA2ZrnsJEN7gnsMq2GSFUkUDZGvIWVZPIU4YZAg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-fast/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/axios-fast/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017776","import_time":"2026-08-14T14:28:08.25651056Z","modified_time":"2026-08-14T14:14:31Z","sha256":"fb41ba4304bae7ef1cc71fa25060b50c201e51bee9989b1e34a0515fc1d31829","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-017903","import_time":"2026-08-14T15:21:28.991935591Z","modified_time":"2026-08-14T15:18:15Z","sha256":"9cc76e819084a35126e067bd65bd3cf2fc52b6d8e068b67d14360ef71505fa7e","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}