If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885)
axois-http is a typosquat of axios (index.js exports an empty object). Its scripts/postinstall.js unconditionally POSTs a JSON body containing a detected-platform label (Windows/MacOS/Linux, with WSL detection via /proc/version and /proc/sys/kernel/osrelease) to a hardcoded bare-IP endpoint http://193.70.34.101:20099/vote at npm install time. On Windows or WSL, the script XOR-decodes a hidden URL (key 'stf2026', decoded prefix 'https://') and a XOR-decoded PowerShell launcher command, downloads a native binary to %TEMP%\main.exe via fetchAddonBinary, and spawns it detached with windowsHide:true and stdio:'ignore'. URL, PowerShell command, and surrounding bridge script fragments are stored as byte arrays and decoded at runtime via unpackSegment(data, 'stf2026') solely to hide the payload URL and shell command. The package has no legitimate need for a native binary and offers no first-party functionality.