OpenSSF/OSV advisory MAL-2026-14029 confirms this npm version as malicious. axios-fast@1.0.0 is a typosquat of axios whose package.json declares a preinstall lifecycle hook that runs a Node one-liner POSTing JSON.stringify({ nodeEnv: process.env }) to https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/ on npm install...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in axios-fast (npm)
Details
axios-fast@1.0.0 is a typosquat of axios whose package.json declares a preinstall lifecycle hook that runs a Node one-liner POSTing JSON.stringify({ nodeEnv: process.env }) to https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/ on npm install. This dumps the installer's full environment (which on developer machines and CI runners typically contains cloud credentials, registry tokens, CI secrets, and API keys) to an attacker-controlled webhook.site collector, with no relation to any legitimate HTTP-client functionality the package name implies.
Decision reason
OpenSSF Malicious Packages via OSV confirms axios-fast@1.0.0 as malicious (MAL-2026-14029): Malicious code in axios-fast (npm)