vitest-axios @1.0.4

Summary

Package published as vitest-axios re-ships axios source, README, homepage, and repository metadata to impersonate the legitimate axios HTTP client. In dist/node/axios.cjs (the declared main ), a top-level var fs = require('fs-extra-core'); replaces upstream axios's require('fs') , and fs-extra-core@^1.3.4 is declared in dependencies — a lookalike of the legitimate fs-extra package. Because the require sits at the top of the main module, whatever fs-extra-core exports or executes runs on every require('vitest-axios') / import 'vitest-axios' , resolving attacker-controlled code into the installer's dependency tree at import time. Package metadata (name, description, keywords, repository axios/axios , homepage axios-http.com , README titled axios-native , copyright dated 2026) is engineered to deceive installers into believing they are installing axios or a vitest-axios integration.

Source: amazon-inspector (3e61d93e82877f836aaba3dd528e79f3e5f4b1bd12ce64b40202bbecd08a2747)