axios-native@1.16.3

Analysis

Package name 'axios-native' is a combosquat of the popular 'axios' HTTP library. The npm maintainer name 'jasonsayman' typosquats the real axios maintainer 'jasonsaayman'. The package claims the real axios GitHub repository (github[.]com/axios/axios) as its own. It ships a verbatim copy of the axios v1.16.3 source code with no injected payload in this version — the impersonation is the attack vector, designed to trick developers into installing it as a trust-building step before a later version introduces malicious behaviour.