针对 axios 1.14.1 的主动供应链攻击
2 分•作者: lemax•5 个月前
axios@1.14.1，发布于2026-03-31，引入了一个新的依赖项 plain-crypto-js@4.2.1，而 axios@1.14.0 中没有这个依赖项。该软件包是恶意的——它包含一个混淆的 postinstall 脚本 (setup.js)，用于下载并执行远程负载。
证据
axios@1.14.0 的依赖项：follow-redirects, form-data, proxy-from-env (3 个依赖项)
axios@1.14.1 的依赖项：相同的 3 个 + plain-crypto-js (新的，之前的 axios 版本中没有)
plain-crypto-js 的脚本中包含 "postinstall": "node setup.js"
setup.js 被高度混淆——它解码 base64 字符串，将脚本写入操作系统临时目录，通过 shell (macOS) 或 PowerShell (Windows) 执行它们，然后删除自身。
查看原文
axios@1.14.1, published 2026-03-31, introduces a new dependency plain-crypto-js@4.2.1 that was not present in axios@1.14.0. This package is malicious — it contains an obfuscated postinstall script (setup.js) that downloads and executes a remote payload.<p>Evidence<p>axios@1.14.0 dependencies: follow-redirects, form-data, proxy-from-env (3 deps)<p>axios@1.14.1 dependencies: same 3 + plain-crypto-js (new, not in any prior axios version)<p>plain-crypto-js has "postinstall": "node setup.js" in its scripts<p>setup.js is heavily obfuscated — it decodes base64 strings, writes scripts to the OS temp directory, executes them via shell (macOS) or PowerShell (Windows), then deletes itself