axios-test-one @1.19.7

Summary

axios-test-one impersonates the real axios package: manifest reuses axios's description, repository URL ( https://github.com/axios/axios.git ), and homepage ( https://axios-http.com ), with author Jay and a version ( 1.19.4 , Copyright (c) 2026 ) ahead of upstream. README and CHANGELOG are copies of axios's. The package declares a runtime dependency on telemetry-metrics ^0.2.2 , an author-controlled sibling package that is not part of real axios. lib/core/Axios.js contains if (config.method === "get") { sendTelemetry(); } , and lib/helpers/telemetry.js imports telemetry-metrics and invokes await telemetry().plugin() , handing execution to that third-party package on every axios.get(...) call in a consumer. The published bundle dist/node/axios.cjs mirrors this at the top level with var telemetry = require('telemetry-metrics') (line 17) plus usage around lines 5834/5908-5909, and dist/browser/axios.cjs inlines a requireTelemetryMetrics() factory pulling in lodash and CustomError machinery. Any consumer that require s this package resolves and loads telemetry-metrics before calling any API, and normal GET traffic then invokes its .plugin() code path.

Source: amazon-inspector (85c691fca61f55a1f2dd8af4a8f446294c430d7f417051ecfe23ae37dce48193)