MAL-2026-10727 Malicious code in axios-test-one (npm)

axios-test-one impersonates the real axios package: manifest reuses axios's description, repository URL (https://github.com/axios/axios.git), and homepage (https://axios-http.com), with author Jay and a version (1.19.4, Copyright (c) 2026) ahead of upstream. README and CHANGELOG are copies of axios's. The package declares a runtime dependency on telemetry-metrics ^0.2.2, an author-controlled sibling package that is not part of real axios. lib/core/Axios.js contains if (config.method === "get") { sendTelemetry(); }, and lib/helpers/telemetry.js imports telemetry-metrics and invokes await telemetry().plugin(), handing execution to that third-party package on every axios.get(...) call in a consumer. The published bundle dist/node/axios.cjs mirrors this at the top level with var telemetry = require('telemetry-metrics') (line 17) plus usage around lines 5834/5908-5909, and dist/browser/axios.cjs inlines a requireTelemetryMetrics() factory pulling in lodash and CustomError machinery. Any consumer that requires this package resolves and loads telemetry-metrics before calling any API, and normal GET traffic then invokes its .plugin() code path.