The axios-fast package versions 1.0.0 and 1.0.1 include a preinstall lifecycle script that runs automatically during npm install. This script executes a Node.js one-liner that posts the entire process environment variables to a hardcoded webhook.site URL controlled by an attacker. This behavior results in the exfiltration of potentially sensitive environment variables, including CI/build secrets like AWS_*, NPM_TOKEN, and GH_TOKEN. The package is malicious and designed to harvest secrets rather than provide useful functionality.

Installation of axios-fast versions 1.0.0 or 1.0.1 can lead to the disclosure of all environment variables on the host machine to a third party. This includes sensitive credentials and tokens commonly used in continuous integration and deployment pipelines, potentially leading to unauthorized access to cloud resources, package repositories, and source code management systems.

Avoid using the axios-fast package entirely. Since this is a malicious package, the best mitigation is to remove it from any dependency trees and replace it with the legitimate axios package or other trusted alternatives. There is no official patch or fix for this package; remediation involves removing the package and auditing for any leaked secrets. Rotate any credentials that may have been exposed if this package was installed.