The 'axois-utils' npm package, a single-character typo-squatting variant of 'axios', contains malicious code executed via preinstall, install, and postinstall hooks. The postinstall.js script harvests a wide range of sensitive files and environment data from the victim's system, including SSH keys, AWS, Google Cloud, Azure credentials, npm configuration, shell histories, browser profiles, crypto wallets, and recursively scans common project directories for .env files. This data is exfiltrated via plain HTTP to a hardcoded IP address. The package's exposed API is non-functional, serving only to mask its malicious intent. Source comments explicitly label the installers as victims, confirming the package's malicious purpose.

Users who install affected versions of 'axois-utils' risk having extensive sensitive information stolen from their systems, including private keys, cloud credentials, environment variables, and development secrets. This can lead to unauthorized access to cloud resources, code repositories, personal accounts, and potentially financial assets. The data exfiltration occurs silently during installation, increasing the risk of unnoticed compromise.

No official patch or remediation is currently documented. Users should avoid installing or using the 'axois-utils' package entirely. Verify package names carefully to avoid typo-squatting attacks. Remove any instances of this package from projects and systems. Monitor for suspicious network traffic to the indicated IP address. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.