[email protected], published 2026-03-31, introduces a new dependency [email protected] that was not present in [email protected]. This package is malicious — it contains an obfuscated postinstall script (setup.js) that downloads and executes a remote payload.
[email protected] dependencies: same 3 + plain-crypto-js (new, not in any prior axios version)
plain-crypto-js has "postinstall": "node setup.js" in its scripts
setup.js is heavily obfuscated — it decodes base64 strings, writes scripts to the OS temp directory, executes them via shell (macOS) or PowerShell (Windows), then deletes itself
Evidence
[email protected] dependencies: follow-redirects, form-data, proxy-from-env (3 deps)
[email protected] dependencies: same 3 + plain-crypto-js (new, not in any prior axios version)
plain-crypto-js has "postinstall": "node setup.js" in its scripts
setup.js is heavily obfuscated — it decodes base64 strings, writes scripts to the OS temp directory, executes them via shell (macOS) or PowerShell (Windows), then deletes itself