// npm package
axois-utils
Utility functions for Axios HTTP client
versions
6
maintainers
1
license
MIT
first publish
2026-05-16
publisher
deadcode09284814
tarball
4,056,255 B
AUTO-PUBLISHED·1 version indexed·latest published 2026-05-16
// exfil path
what is read → where it shipssteals
- ● Crypto wallet
- ○ home dir
- ○ system info
sends to
(no destination string extracted — payload may be dynamic / obfuscated)
evidence in excerpt
> const { exec, spawn } = require('child_process');
> const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`;// publisher campaignby deadcode09284814
2 caught packages from this accountThis is not an isolated catch. The same publisher has shipped 1 other package that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.
// offending code· @1.0.9· 1 file flagged
llm: benign · 0.85→ No suspicious destination, no remote-exec shape — 1 other host(s).
- @1.0.9··AUTO-PUBLISHED·publisher: deadcode09284814heuristic 100/100static flags 5llm benign (0.85) via ollamainstall-scripts:preinstall,install,postinstallnew-publisher:10dpublisher-handle-randomlookinghas-source-repoosv-flagged:MAL-2026-4494reads-wallet-filesreads-env-varsreads-homedirreads-system-infochild-process-spawn
→ No suspicious destination, no remote-exec shape — 1 other host(s).
// NHI intent1 target·mixed harvest patterns·gate: always