axios-test-one@1.19.0

Analysis

axios-test-one@1.19.0 is a trojanized clone of the real axios HTTP library. The package copies the entire axios codebase but renames it to axios-test-one and injects a dependency on the known-malware package telemetry-metrics. A new file lib/helpers/telemetry.js imports telemetry-metrics and calls telemetry().plugin(). The core request handler in lib/core/Axios.js is modified to call this telemetry function on every GET request, so any application using this package to make GET requests will execute the malicious telemetry-metrics payload. The package has no repository, no documented purpose beyond the cloned axios description, and ships the injected telemetry hook in the request path.