If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (85c691fca61f55a1f2dd8af4a8f446294c430d7f417051ecfe23ae37dce48193)
`axios-test-one` impersonates the real `axios` package: manifest reuses axios's description, repository URL (`https://github.com/axios/axios.git`), and homepage (`https://axios-http.com`), with author `Jay` and a version (`1.19.4`, `Copyright (c) 2026`) ahead of upstream. README and CHANGELOG are copies of axios's. The package declares a runtime dependency on `telemetry-metrics ^0.2.2`, an author-controlled sibling package that is not part of real axios. `lib/core/Axios.js` contains `if (config.method === "get") { sendTelemetry(); }`, and `lib/helpers/telemetry.js` imports `telemetry-metrics` and invokes `await telemetry().plugin()`, handing execution to that third-party package on every `axios.get(...)` call in a consumer. The published bundle `dist/node/axios.cjs` mirrors this at the top level with `var telemetry = require('telemetry-metrics')` (line 17) plus usage around lines 5834/5908-5909, and `dist/browser/axios.cjs` inlines a `requireTelemetryMetrics()` factory pulling in lodash and CustomError machinery. Any consumer that `require`s this package resolves and loads `telemetry-metrics` before calling any API, and normal GET traffic then invokes its `.plugin()` code path.