MAL-2026-10727

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/axios-test-one/MAL-2026-10727.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10727
Published
2026-07-16T18:45:35Z
Modified
2026-08-19T02:45:11.163439968Z
Summary
Malicious code in axios-test-one (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (85c691fca61f55a1f2dd8af4a8f446294c430d7f417051ecfe23ae37dce48193)

axios-test-one impersonates the real axios package: manifest reuses axios's description, repository URL (https://github.com/axios/axios.git), and homepage (https://axios-http.com), with author Jay and a version (1.19.4, Copyright (c) 2026) ahead of upstream. README and CHANGELOG are copies of axios's. The package declares a runtime dependency on telemetry-metrics ^0.2.2, an author-controlled sibling package that is not part of real axios. lib/core/Axios.js contains if (config.method === "get") { sendTelemetry(); }, and lib/helpers/telemetry.js imports telemetry-metrics and invokes await telemetry().plugin(), handing execution to that third-party package on every axios.get(...) call in a consumer. The published bundle dist/node/axios.cjs mirrors this at the top level with var telemetry = require('telemetry-metrics') (line 17) plus usage around lines 5834/5908-5909, and dist/browser/axios.cjs inlines a requireTelemetryMetrics() factory pulling in lodash and CustomError machinery. Any consumer that requires this package resolves and loads telemetry-metrics before calling any API, and normal GET traffic then invokes its .plugin() code path.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "5f53cd512e7aa0549f6ff4ae3064dc13fd8d72c8dddc464f7639376abfadc4a6",
            "versions": [
                "1.19.0"
            ],
            "import_time": "2026-07-16T18:54:04.018937255Z",
            "id": "IN-MAL-2026-010773",
            "modified_time": "2026-07-16T18:45:35Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "1.19.1"
            ],
            "import_time": "2026-08-19T02:31:08.264226815Z",
            "sha256": "2481aaca0a26e487bee4ad7ac8c1f9b87d52c30fe21d9ed9ff0e7bb482db9534",
            "id": "IN-MAL-2026-018285",
            "modified_time": "2026-08-19T01:59:11Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "1.19.6"
            ],
            "import_time": "2026-08-19T02:31:08.188347608Z",
            "sha256": "2b7412a87f5e47fb7f3a708b51b24902fafe789e73e6f2095c5ee74c785c6ed2",
            "id": "IN-MAL-2026-018284",
            "modified_time": "2026-08-19T01:59:05Z",
            "source": "amazon-inspector"
        },
        {
            "sha256": "45f0d9827fe696432460a45fb65195e725fe6064c531cdb3a9088802f9e75afa",
            "versions": [
                "1.19.5"
            ],
            "import_time": "2026-08-19T02:31:08.110373005Z",
            "id": "IN-MAL-2026-018283",
            "modified_time": "2026-08-19T01:58:55Z",
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-19T02:31:07.929695162Z",
            "sha256": "5853eed6bf9f20a9efa506a222b4e8a0224f72e6ac4108b0bfdf285a9a617659",
            "versions": [
                "1.19.2"
            ],
            "id": "IN-MAL-2026-018281",
            "modified_time": "2026-08-19T01:58:39Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "1.19.4"
            ],
            "import_time": "2026-08-19T02:31:08.018469831Z",
            "sha256": "85c691fca61f55a1f2dd8af4a8f446294c430d7f417051ecfe23ae37dce48193",
            "id": "IN-MAL-2026-018282",
            "modified_time": "2026-08-19T01:58:47Z",
            "source": "amazon-inspector"
        },
        {
            "sha256": "92ef19e466cb6036e09b3acbe0ac6b4dced7f74fb261681bbed8b286776ffd31",
            "versions": [
                "1.19.7"
            ],
            "import_time": "2026-08-19T02:31:08.527487274Z",
            "id": "IN-MAL-2026-018288",
            "modified_time": "2026-08-19T01:59:34Z",
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "1.19.3"
            ],
            "import_time": "2026-08-19T02:31:08.337140594Z",
            "sha256": "abc28482372ce03b07ed96182a16a1c4b572bddd6e91ad8a816b45d53d335da3",
            "id": "IN-MAL-2026-018286",
            "modified_time": "2026-08-19T01:59:19Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / axios-test-one

Package

Name
axios-test-one
View open source insights on deps.dev
Purl
pkg:npm/axios-test-one

Affected ranges

Affected versions

1.*
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.19.5
1.19.6
1.19.7

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "axios-test-one-1.19.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-RExEvU07uhqy1eWiT3T3sCZye5q8mKO3fhfP6H1TOcfv48iO0g5TlnZ5fHR4KCay/wo/WjSZ4lmGojBW14dSOA==",
                "sha1": "b0bf5c2f84d8bc1fd3f724f15704ce2461853c92"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "16fd2ae8bc57e00c0f39dca2b9ccd20449250d443103117dbaf3bfdba3a0908d",
            "path": "lib/helpers/telemetry.js",
            "tlsh": "f9b01282234255c90c70fbbb463b0411933aceb41d04634190404373041d40cf1c1c2c"
        },
        {
            "sha256": "80f9e324c4d7bb815534d90fae87f64f22fed2effcede518d4f7b93f370a30a4",
            "path": "package.json",
            "tlsh": "7dd1db62c89a4d572fe439acac9b5555a231804fcc41fa08736e428d4f4d72f32fb66e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/axios-test-one/MAL-2026-10727.json"