GCVE-110-OSM-2026-8522

This package is a trojanized axios clone published by 'gsanbus', a brand-new account (4 days old) whose only other package 'axios-test-one' is already confirmed malicious in OSM (publisherMaliciousRatio = 1.0). Deobfuscation of dist/node/axios.cjs recovered hidden C2 indicators including 'http://[::ffff:192.168.1.5', '40email.com', and '1.global', all classified as exfil/custom-c2 endpoints — these IOCs were concealed within what appears to be a lightly modified copy of the legitimate axios library. The package also depends on a known-malicious 'chalk' dependency, and the obfuscation layer in dist/node/axios.cjs yielded 6 recovered IOCs with a deobfuscation outcome of 'iocs-recovered', confirming active payload hiding. The attacker model is a supply-chain trojan: impersonate the popular axios library, hide exfiltration infrastructure in the bundled CJS distribution, and leverage the legitimate-looking source to evade detection. ENTRY dist/node/axios.cjs (main: ./dist/node/axios.cjs) DESTINATION - custom-c2: http://[::ffff:192.168.1.5 (primary, deobfuscated) in dist/node/axios.cjs - custom-c2: 40email.com (deobfuscated) in dist/axios.js - custom-c2: 1.global (deobfuscated) in dist/axios.js - custom-c2: 0:0:0:0:0:0:0:1 (deobfuscated) in dist/node/axios.cjs EXFIL - Data Encoding for Exfiltration in dist/axios.js: "btoa(" - Data Encoding for Exfiltration in dist/browser/axios.cjs: "btoa(" - Data Encoding for Exfiltration in dist/esm/axios.js: "btoa(" - Data Encoding for Exfiltration in dist/node/axios.cjs: "Buffer.from(proxyAuth, 'utf8').toString('base64')" - Data Encoding for Exfiltration in lib/adapters/fetch.js: "btoa(" - Data Encoding for Exfiltration in lib/adapters/http.js: "Buffer.from(proxyAuth, 'utf8').toString('base64')" - Data Encoding for Exfiltration in lib/helpers/AxiosURLSearchParams.js: "encodeURIComponent(str).replace(/[!'()~]|%20/g, function replacer(match" - Data Encoding for Exfiltration in lib/helpers/buildURL.js: "encodeURIComponent(val" (+4 more) OBFUSCATION - IOCs Found in Deobfuscated Code in dist/node/axios.cjs - Dynamic Base64 Decoding in dist/node/axios.cjs: "Buffer.from(body, 'base64')" - Dynamic Base64 Decoding in lib/helpers/fromDataURI.js: "Buffer.from(body, 'base64')" - Strings Extracted from Deobfuscated Code in lib/helpers/fromDataURI.js - recovered 1 ipv6, 1 urls, 2 domains, 2 _domainCandidates from decoded/deobfuscated content ADDITIONAL FINDINGS - Dynamic Code Execution in dist/axios.js: "exec(str)" - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Malicious Dependency Detected in package.json PAYLOAD FILES dist/node/axios.cjs INDICATORS (IOCs) - urls: https://user:p%40ss@host`, https://axios-http.com/, https://opencollective.com/axios/contribute, https://stytch.com/, https://stytch.com (+28 more) - domains: axios-http.com, thanks.dev, images.opencollective.com, Thanks.dev, www.principal.com (+33 more) - payloadFileHash: 241146620c67551291fef242d9ab9fd9b28f1e0e14ae311e7db759d36942b574