{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "8f15d9ae65c6ea4dd4fec2b96c68d01cc60fa25c5d0d895f6253caa2002aa476",
              "tlsh": "07d1ed62c89a4d572fe43aa8a85a9155b235c04fcc41f91d73ae424c4f4c72f32fb66e"
            }
          ],
          "package_integrity": [
            {
              "filename": "axiosqqq-1.16.2.tgz",
              "hashes": {
                "sha1": "5e110fd6fa3afa14bf2671d756baa9f2972d3e27",
                "sha512_sri": "sha512-an9BYensuEdOipJmFz/W9w2FhS4/ANZMs41uj+kRxzITC666Rdso+kVygGVCeYS3CgEeoFl3JqHODyTqDNl0xw=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "axiosqqq"
      },
      "versions": [
        "1.16.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-003459",
        "import_time": "2026-05-26T05:50:40.973991855Z",
        "modified_time": "2026-05-20T04:16:47Z",
        "sha256": "a9cf5bc7a896b21f9af923c60b9283758bf46d4fb279f752a42bae43bb6006aa",
        "source": "amazon-inspector",
        "versions": [
          "1.16.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a9cf5bc7a896b21f9af923c60b9283758bf46d4fb279f752a42bae43bb6006aa)\nPackage name `axiosqqq` is a 3-character-suffix typosquat of `axios` and ships axios\u0027s verbatim source, README, and CHANGELOG to impersonate the legitimate package. The only material divergence from upstream axios is an added runtime dependency in package.json: `\"@caspianph/storyteller\": \"^1.0.0\"`. No file in the tarball imports or references this dependency, so it serves no functional purpose in the package; its only effect is that `npm install axiosqqq` resolves and installs `@caspianph/storyteller`, whose lifecycle hooks and main module will execute in the installer\u0027s environment. This is the namespace-abuse / smuggled-transitive-dependency pattern: the lure package mimics a top-tier registry name to get installed, and the actual payload is the unrelated scoped package pulled in transitively. The static C2/POST/ping pattern matches fire on the bundled axios.cjs and reflect axios\u0027s normal HTTP-client surface (POST, fetch, ping helpers) rather than added exfiltration code \u2014 the typosquat\u0027s harm is structural, via the injected dependency, not via modifications to the axios bundle itself.\n",
  "id": "MAL-2026-4493",
  "modified": "2026-05-20T04:16:47Z",
  "published": "2026-05-20T04:16:47Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/axiosqqq/v/1.16.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in axiosqqq (npm)"
}