MalwarePublished 1 Nov 2026

@axon-web/icons (npm) · Malicious Code

Affects @axon-web/iconsSource GCVE Database

Malicious package : remove @axon-web/icons and rotate any secrets on hosts that installed it.

Data as of 1 Nov 2026, 09:22 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-18433

What to do

Remove @axon-web/icons from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@axon-web/icons	Affected =99.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @axon-web/icons version 99.0.0 is a malicious package that performs unauthorized data exfiltration upon loading. It constructs an identifier from the host's OS hostname and environment username, then leaks this information via DNS requests to an attacker-controlled domain. Additionally, it scans environment variables for names containing sensitive keywords related to credentials and outputs these key names, indicating reconnaissance activity. The package contains no legitimate icon content and appears to be a dependency confusion or typosquatting attack.

Impact

This malicious package leaks sensitive system information such as the hostname and OS username to an attacker-controlled DNS server during module load. It also performs reconnaissance by identifying environment variables that may contain credentials or secrets, potentially aiding further attacks. This compromises confidentiality and may facilitate credential theft or unauthorized access.

Defensive guidance

Users should immediately remove the @axon-web/icons package version 99.0.0 from their projects and avoid installing packages from untrusted or suspicious sources. Verify package authenticity before installation and monitor for dependency confusion or typosquatting attempts.

Summary

The @axon-web/icons npm package at version 99.0.0 is malicious. Upon requiring the module, its index.js script constructs an identifier using the system's hostname and the USER or USERNAME environment variable. It then performs a DNS resolution query to a subdomain of nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun, an out-of-band data collection domain controlled by attackers, thereby leaking the installer's hostname and OS username. The same script enumerates environment variable keys matching patterns related to tokens, secrets, keys, passwords, AWS, GitHub, and npm credentials, writing the matching key names to standard output. The package contains no actual icon content, consistent with a malicious payload designed for dependency confusion or typosquatting rather than legitimate use.

References

npmjs.com/package/@axon-web/icons/v/99.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 1 Nov 2026, 09:22 UTC

Technical details

References

Community reviews