GCVE-110-OSM-2026-10389

This package is a typosquatted clone of the legitimate axios library (masquerading as 'ca-axios' v1.14.0, attributed to 'Matt Zabriskie') published by 'caspianph', a publisher with a 100% malicious ratio across all previously checked packages (@caspianph/storyteller and axiosqqq, both OSM-confirmed malicious). The critical finding is the declared dependency on '@caspianph/first-npm-package', which is independently confirmed malicious in OSM — this is a classic supply-chain attack where the trojanized axios clone pulls in a malicious payload package at install time. The surface-level code in the entrypoint appears to be copied legitimate axios source, consistent with the attacker strategy of hiding malicious behavior in a dependency rather than in the top-level package itself. The combination of a serial malicious publisher, a known-bad dependency, and impersonation of the axios brand unambiguously identifies this as a malicious package. ENTRY dist/node/axios.cjs (main: ./dist/node/axios.cjs) EXFIL - Data Encoding for Exfiltration in dist/axios.js: "btoa(" - Data Encoding for Exfiltration in dist/browser/axios.cjs: "btoa(" - Data Encoding for Exfiltration in dist/esm/axios.js: "btoa(" - Data Encoding for Exfiltration in dist/node/axios.cjs: "Buffer.from(proxy.auth, 'utf8').toString('base64')" - Data Encoding for Exfiltration in lib/adapters/http.js: "Buffer.from(proxy.auth, 'utf8').toString('base64')" - Data Encoding for Exfiltration in lib/helpers/AxiosURLSearchParams.js: "encodeURIComponent(str).replace(/[!'()~]|%20|%00/g, function replacer(match" - Data Encoding for Exfiltration in lib/helpers/buildURL.js: "encodeURIComponent(val" - Data Encoding for Exfiltration in lib/helpers/cookies.js: "encodeURIComponent(value" (+1 more) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json - Dynamic Code Execution in dist/axios.js: "exec(str)" - Publisher Has Other Malicious Packages PAYLOAD FILES dist/node/axios.cjs (+ dist/axios.js, dist/browser/axios.cjs)