axois-http

{"modified":"2026-08-18T23:57:25Z","published":"2026-08-18T23:57:25Z","schema_version":"1.7.4","id":"MAL-2026-14163","summary":"Malicious code in axois-http (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885)\naxois-http is a typosquat of axios (index.js exports an empty object). Its scripts/postinstall.js unconditionally POSTs a JSON body containing a detected-platform label (Windows/MacOS/Linux, with WSL detection via /proc/version and /proc/sys/kernel/osrelease) to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote at npm install time. On Windows or WSL, the script XOR-decodes a hidden URL (key 'stf2026', decoded prefix 'https://') and a XOR-decoded PowerShell launcher command, downloads a native binary to %TEMP%\\main.exe via fetchAddonBinary, and spawns it detached with windowsHide:true and stdio:'ignore'. URL, PowerShell command, and surrounding bridge script fragments are stored as byte arrays and decoded at runtime via unpackSegment(data, 'stf2026') solely to hide the payload URL and shell command. The package has no legitimate need for a native binary and offers no first-party functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"axois-http"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"scripts/postinstall.js","sha256":"5ef1d89c5d298d7e8e3f7416dc4422abbc0c1ecfe167a7f1597f07832cc06124","tlsh":"18d13fc61ef59035874bf96884cf9d13b2a6c207330e4a65ff8f42107f5792c85a69ea"}],"package_integrity":[{"filename":"axois-http-1.0.0.tgz","hashes":{"sha1":"5657934992e411f9b316ce7fb5d881825635eec6","sha512_sri":"sha512-wngjplF9Z7m5PYanDzxyszWfTnLsx4bZ2qJAQnLo1PAeLKQe+kPExvsiw+/OSVqrzsV9RRG0D1H/04YowuXmmw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/axois-http/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018238","import_time":"2026-08-19T00:21:11.968090183Z","modified_time":"2026-08-18T23:57:25Z","sha256":"69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885","source":"amazon-inspector","versions":["1.0.0"]}]}}