axois-http@1.0.0

Analysis

axois-http@1.0.0 is a typosquat of the axios HTTP library. Its postinstall hook (scripts/postinstall.js) runs on install and fingerprints the host (platform, architecture, Node version, WSL detection), then POSTs a JSON beacon containing the platform to the C2 endpoint 193[.]70[.]34[.]101:20099/vote. On Windows and WSL hosts it additionally XOR-decodes a remote URL, downloads a binary addon to the temp directory as main.exe, and spawns it as a detached background process (hidden window, stdio ignored) so it outlives the installer; on WSL it executes the addon through a shell bridge command. The C2 host is 193[.]70[.]34[.]101 on port 20099.