This package matches a known-malicious advisory and is blocked by ShadowCanopy by default across every project. 2 flagged versions.
All findings are false positives on legitimate axios source. Patterns like Function(, \xA0/\uFEFF in trim regex, btoa for Basic auth, and regex.exec are normal library code (utils.js, adapters, auth helpers). Minified bundles and timestamps in comments are expected. No malicious behavior present.
AI breakdown
Plain-English summary of what this package does and how it behaves.
axios is a promise-based HTTP client for browser and Node.js that performs HTTP requests using adapters for fetch, http, and xhr.
Capabilities
- Makes HTTP requests
- Handles redirects via follow-redirects
- Supports form data uploads
- Runs build scripts with rollup and gulp
- Includes extensive test suite
Data access
- Environment variables (via proxy-from-env)
- Filesystem (for loading local modules)
Network
- Makes outbound HTTP requests
Widely used legitimate HTTP client with standard network behavior; static findings report obfuscated files and hardcoded IPs but these are not corroborated by the provided source samples.
Dependency & execution chain
Every package this one pulls in, colored by verdict. Expand to walk the tree.
Security findings (34)
Static analysis rule matches, with the exact code that triggered them.
Multiple obfuscation patterns in dist/browser/axios.cjs
Multiple obfuscation patterns in package/dist/browser/axios.cjs
Multiple obfuscation patterns in dist/node/axios.cjs
Multiple obfuscation patterns in package/dist/node/axios.cjs
Multiple obfuscation patterns in dist/axios.js
Multiple obfuscation patterns in package/dist/axios.js
Multiple obfuscation patterns in dist/esm/axios.js
Multiple obfuscation patterns in package/dist/esm/axios.js
Multiple obfuscation patterns in dist/axios.min.js
Multiple obfuscation patterns in package/dist/axios.min.js
Multiple obfuscation patterns in dist/esm/axios.min.js
Multiple obfuscation patterns in package/dist/esm/axios.min.js
Multiple obfuscation patterns in lib/helpers/resolveConfig.js
Multiple obfuscation patterns in package/lib/helpers/resolveConfig.js
Multiple obfuscation patterns in lib/utils.js
Multiple obfuscation patterns in package/lib/utils.js
File dist/browser/axios.cjs combines network access with process execution
File dist/browser/axios.cjs contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
File package/dist/browser/axios.cjs combines network access with process execution
File package/dist/browser/axios.cjs contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
File dist/node/axios.cjs combines network access with process execution
File dist/node/axios.cjs contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
File package/dist/node/axios.cjs combines network access with process execution
File package/dist/node/axios.cjs contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
File dist/axios.js combines network access with process execution
File dist/axios.js contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
File package/dist/axios.js combines network access with process execution
File package/dist/axios.js contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
File dist/esm/axios.js combines network access with process execution
File dist/esm/axios.js contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
File package/dist/esm/axios.js combines network access with process execution
File package/dist/esm/axios.js contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
File lib/helpers/parseHeaders.js contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
File package/lib/helpers/parseHeaders.js contains a hardcoded public IP (08:58:49) used in network code — review for hidden exfiltration or C2 endpoints.
Known vulnerabilities (35)
Published CVEs / advisories affecting this version.
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
Axios: Header Injection via Prototype Pollution
Allocation of Resources Without Limits or Throttling in Axios
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`
Axios: Excessive recursion in formDataToJSON can cause denial of service
Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0
Axios: unbounded recursion in toFormData causes DoS via deeply nested request data
Axios: Nested axios option objects can consume polluted prototype values
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Axios: Header Injection via Inherited headers After Minimal Interceptor
Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`
Axios: no_proxy bypass via IP alias allows SSRF
Axios: Prototype pollution gadgets can alter axios request construction
Axios: HTTP/2 streamed uploads bypass `maxBodyLength`
Axios: Deep formToJSON Key Recursion Can Cause Denial of Service
Axios: HTTP adapter streamed responses bypass maxContentLength
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests
Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams
Package metadata
Promise based HTTP client for the browser and node.js
Files in package (172)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/axios