axiosqqq@1.16.3

Analysis

axiosqqq is a combosquatted copy of the popular axios HTTP library (the package name substitutes 'qqq' for part of 'axios'). The package itself contains an unmodified copy of axios's source code with no malicious code directly embedded. However, it declares a production dependency on @caspianph/storyteller, a known-malicious package. Installing axiosqqq pulls this dependency into node_modules, where its install-time lifecycle hooks execute — delivering the actual payload. Attackers use this pattern to evade static analysis: the combosquatted host package appears clean while the malicious dependency delivers the compromise.