Malicious Code Detected in axioss Package - Security Alert
Summary
MAL-2025-15242: Malicious code in axioss (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The axioss package is a JavaScript library designed for making HTTP requests, commonly used in web applications to interact with APIs. It provides a simple and intuitive interface for sending asynchronous requests, handling responses, and managing configurations. However, the package has been found to contain malicious code, posing a significant security risk to applications that rely on it.
Vulnerability Detail
The vulnerability in the axioss package originates from the inclusion of malicious code that can compromise the security of applications utilizing this package. This malicious code may lead to unauthorized access, data breaches, or other harmful actions within the affected systems. The presence of such code can severely impact the integrity and confidentiality of user data, making it crucial for developers to address this issue promptly.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall axiossIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the axioss package altogether and consider using a well-known and trusted alternative, such as axios or fetch, for making HTTP requests in your application.
Conclusion
The discovery of malicious code in the axioss package highlights the importance of maintaining secure coding practices and regularly monitoring dependencies. Developers should take immediate action to remove the affected package and consider alternatives to safeguard their applications.
See every vulnerability recorded for axioss →
FAQ
The axioss package is a JavaScript library used for making HTTP requests in web applications.
The malicious code can lead to unauthorized access and potential data breaches within applications using the package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
You should remove axioss from your project and replace it with a secure alternative, or update to a patched version if available.
Regularly monitor your dependencies for vulnerabilities using tools like Vulert, and keep your packages updated to their latest secure versions.
Related vulnerabilities
Recent vulnerabilities recorded for axioss.
