axios-native @1.16.4

Summary

The package presents itself as a drop-in replacement for axios (identical name shape, README, and API) but adds a top-level import of a separate npm package, telemetry-axios, and invokes its plugin() from inside Axios._request whenever config.method === 'get'. The helper lib/helpers/telemetry.js is a two-line wrapper that calls telemetry().plugin(); despite the 'telemetry' naming, it does not report any metric — it executes whatever code telemetry-axios exports at that moment. Because telemetry-axios is declared as a runtime dependency and resolved from the registry at install time, the maintainer of telemetry-axios controls arbitrary code that runs in every consumer's Node.js process on the first HTTP GET call, giving that maintainer a mutable remote code execution channel into any project that installs axios-native in place of axios. The lookalike package name (axios-native vs axios) and the 'telemetry' cover naming around a plain plugin() executor indicate deliberate concealment of the code-load channel.

Source: amazon-inspector (b0d01cf6414d6896b4f60ac6e2ecc238d33c049b6f6f5add44bd7700de32a906)