MAL-2026-14163

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/axois-http/MAL-2026-14163.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14163
Published
2026-08-18T23:57:25Z
Modified
2026-08-19T00:30:11.521636419Z
Summary
Malicious code in axois-http (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885)

axois-http is a typosquat of axios (index.js exports an empty object). Its scripts/postinstall.js unconditionally POSTs a JSON body containing a detected-platform label (Windows/MacOS/Linux, with WSL detection via /proc/version and /proc/sys/kernel/osrelease) to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote at npm install time. On Windows or WSL, the script XOR-decodes a hidden URL (key 'stf2026', decoded prefix 'https://') and a XOR-decoded PowerShell launcher command, downloads a native binary to %TEMP%\main.exe via fetchAddonBinary, and spawns it detached with windowsHide:true and stdio:'ignore'. URL, PowerShell command, and surrounding bridge script fragments are stored as byte arrays and decoded at runtime via unpackSegment(data, 'stf2026') solely to hide the payload URL and shell command. The package has no legitimate need for a native binary and offers no first-party functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885",
            "modified_time": "2026-08-18T23:57:25Z",
            "import_time": "2026-08-19T00:21:11.968090183Z",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-018238"
        }
    ]
}
References
Credits

Affected packages

npm / axois-http

Package

Name
axois-http
View open source insights on deps.dev
Purl
pkg:npm/axois-http

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/axois-http/MAL-2026-14163.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "18d13fc61ef59035874bf96884cf9d13b2a6c207330e4a65ff8f42107f5792c85a69ea",
            "sha256": "5ef1d89c5d298d7e8e3f7416dc4422abbc0c1ecfe167a7f1597f07832cc06124",
            "path": "scripts/postinstall.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "axois-http-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-wngjplF9Z7m5PYanDzxyszWfTnLsx4bZ2qJAQnLo1PAeLKQe+kPExvsiw+/OSVqrzsV9RRG0D1H/04YowuXmmw==",
                "sha1": "5657934992e411f9b316ce7fb5d881825635eec6"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]