OpenSSF/OSV advisory MAL-2026-10727 confirms this npm version as malicious. `axios-test-one` impersonates the real `axios` package: manifest reuses axios's description, repository URL (`https://github.com/axios/axios.git`), and homepage (`https://axios-http.com`), with author `Jay` and a version (`1.19.4`, `Copyright (c) 2026`) ahead of upstream. README and CHANGELOG are copies of axios's. The package declares a runtime dependency on `telemetry-metrics ^0.2.2`, an author-controlled sibling...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in axios-test-one (npm)
Details
`axios-test-one` impersonates the real `axios` package: manifest reuses axios's description, repository URL (`https://github.com/axios/axios.git`), and homepage (`https://axios-http.com`), with author `Jay` and a version (`1.19.4`, `Copyright (c) 2026`) ahead of upstream. README and CHANGELOG are copies of axios's. The package declares a runtime dependency on `telemetry-metrics ^0.2.2`, an author-controlled sibling package that is not part of real axios. `lib/core/Axios.js` contains `if (config.method === "get") { sendTelemetry(); }`, and `lib/helpers/telemetry.js` imports `telemetry-metrics` and invokes `await telemetry().plugin()`, handing execution to that third-party package on every `axios.get(...)` call in a consumer. The published bundle `dist/node/axios.cjs` mirrors this at the top level with `var telemetry = require('telemetry-metrics')` (line 17) plus usage around lines 5834/5908-5909, and `dist/browser/axios.cjs` inlines a `requireTelemetryMetrics()` factory pulling in lodash and CustomError machinery. Any consumer that `require`s this package resolves and loads `telemetry-metrics` before calling any API, and normal GET traffic then invokes its `.plugin()` code path.
Decision reason
OpenSSF Malicious Packages via OSV confirms axios-test-one@1.19.6 as malicious (MAL-2026-10727): Malicious code in axios-test-one (npm)