registry / axios-test-one / 1.18.4

axios-test-one@1.18.4

Promise based HTTP client for the browser and node.js

AI Security Review

scanned 4h ago · by lpm-firewall-ai

The ESM request path adds unconsented system profiling to normal Axios GET calls. It attempts to transmit that profile to a local listener and, as written, likely breaks GET requests before dispatch.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A consumer makes an Axios GET request through the ESM/lib entrypoint.

Impact

Unconsented host-data collection attempt and likely denial of service for GET requests.

Mechanism

Automatic host fingerprinting with attempted loopback telemetry.

Attack narrative

On each GET request, `lib/core/Axios.js` calls a newly added host-profile collector and telemetry sender. The collector gathers machine and username metadata; the sender is designed to POST it to `127.0.0.1:5000/report` without caller consent. The call passes the data in the wrong argument position, so it likely throws before sending, but the hidden collection/exfiltration path is concrete and also disrupts GET traffic.

Rationale

This package injects non-Axios host profiling and hidden telemetry into ordinary user-initiated GET requests. The broken invocation limits successful exfiltration but does not make the implanted behavior benign.

Evidence

package.jsonindex.jslib/core/Axios.jslib/helpers/readJson.jslib/helpers/telemetry.js

Network endpoints1

127.0.0.1:5000/report

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

`lib/core/Axios.js` imports host-data and telemetry helpers.
Every GET request calls `sendTelemetry(readJson())` before dispatch.
`lib/helpers/readJson.js` collects hostname, OS, CPU, memory, username, Node version, and PID.
`lib/helpers/telemetry.js` posts JSON to loopback port 5000 without user opt-in.

Evidence against

The telemetry helper targets only `127.0.0.1`, not an external host.
The one-argument call leaves telemetry data undefined, likely throwing before the POST is sent.
No lifecycle hook invokes the collection code at install time.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 75 file(s), 1.01 MB of source, external domains: www.google.com

Source & flagged code

3 flagged

dist/node/axios.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = axios-test-one@1.18.9 matchedIdentity = npm:YXhpb3MtdGVzdC1vbmU:1.18.9 similarity = 0.903 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/node/axios.cjsView on unpkg

README.mdView file

Lines 875-915markdown

875 adapter: function (config) {

876 /* ... */

877 },

878 // Also, you can set the name of the built-in adapter, or provide an array with their names

879 // to choose the first available in the environment

880 adapter: 'xhr', // 'fetch' | 'http' | ['xhr', 'http', 'fetch']

881

882 // `auth` indicates that HTTP Basic auth should be used, and supplies credentials.

883 // This will set an `Authorization` header, overwriting any existing

884 // `Authorization` custom headers you have set using `headers`.

885 // If `auth` is omitted, the Node.js HTTP and fetch adapters can read

886 // HTTP Basic auth credentials from the request URL, for example

887 // `https://user:pass@example.com`. Axios decodes percent-encoded URL

888 // credentials, and `auth` takes precedence over URL-embedded credentials.

889 // The Node.js HTTP adapter preserves Basic auth on same-origin redirects

890 // and strips it on cross-origin redirects.

891 // Please note that only HTTP Basic auth is configurable through this parameter.

892 // For Bearer tokens and such, use `Authorization` custom headers instead.

893 auth: {

894 username: 'janedoe',

895 password: 's00pers3cret'

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L895

896 },

897

898 // `responseType` indicates the type of data that the server will respond with

899 // options are: 'arraybuffer', 'document', 'json', 'text', 'stream'

900 // browser only: 'blob'

901 responseType: 'json', // default

902

903 // `responseEncoding` indicates encoding to use for decoding responses (Node.js only)

904 // Note: Ignored for `responseType` of 'stream' or client-side requests

905 // options are: 'ascii', 'ASCII', 'ansi', 'ANSI', 'binary', 'BINARY', 'base64', 'BASE64', 'base64url',

906 // 'BASE64URL', 'hex', 'HEX', 'latin1', 'LATIN1', 'ucs-2', 'UCS-2', 'ucs2', 'UCS2', 'utf-8', 'UTF-8',

907 // 'utf8', 'UTF8', 'utf16le', 'UTF16LE'

908 responseEncoding: 'utf8', // default

909

910 // `xsrfCookieName` is the name of the cookie to use as a value for the xsrf token

911 xsrfCookieName: 'XSRF-TOKEN', // default

912

913 // `xsrfHeaderName` is the name of the http header that carries the xsrf token value

914 xsrfHeaderName: 'X-XSRF-TOKEN', // default

915

Lines 1059-1099markdown

1059 // `rejectUnauthorized` to the generated tunneling agent, so they still apply

1060 // to the origin TLS connection.

1061 // If you supply an `HttpsProxyAgent`, axios leaves tunneling to that agent.

1062 // If the proxy server uses HTTPS, then you must set the protocol to `https`.

1063 // A user-supplied `Host` header in `headers` is preserved when forwarding

1064 // through a proxy (case-insensitive match on `host`/`Host`/`HOST`); this

1065 // lets you target a virtual host that differs from the request URL, for

1066 // example, hitting

Source & flagged code

3 flagged · loading source

dist/node/axios.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/node/axios.cjsView on unpkg

README.mdView file

895patternName = generic_password severity = medium line = 895 matchedText = password...ret'

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L895

1079patternName = generic_password severity = medium line = 1079 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L1079

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltadist/node/axios.cjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret PatternREADME.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings