MAL-2026-14163
Malicious code in axois-http (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885) axois-http is a typosquat of axios (index.js exports an empty object). Its scripts/postinstall.js unconditionally POSTs a JSON body containing a detected-platform label (Windows/MacOS/Linux, with WSL detection via /proc/version and /proc/sys/kernel/osrelease) to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote at npm install time. On Windows or WSL, the script XOR-decodes a hidden URL (key 'stf2026', decoded prefix 'https://') and a XOR-decoded PowerShell launcher command, downloads a native binary to %TEMP%\main.exe via fetchAddonBinary, and spawns it detached with windowsHide:true and stdio:'ignore'. URL, PowerShell command, and surrounding bridge script fragments are stored as byte arrays and decoded at runtime via unpackSegment(data, 'stf2026') solely to hide the payload URL and shell command. The package has no legitimate need for a native binary and offers no first-party functionality.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for axois-http (npm). Pin to a known-safe version or switch to an alternative.