The '@qwedqwed/axios' package is a malicious npm package designed to impersonate the genuine 'axios' library by copying its README, source code, homepage, repository, and author metadata. Unlike the real axios package, it declares two runtime dependencies '@caspianph/storyteller@^1.1.12' and 'math@^0.0.3', which are not used by the legitimate axios. The 'math' package is a known abandoned utility often targeted for dependency confusion or typosquatting attacks. The actual threat arises from these transitive dependencies that are loaded silently when '@qwedqwed/axios' is installed, potentially leading to full compromise of the host system. The package itself does not contain direct exfiltration code, but the transitive dependencies pose a severe risk.

Any system with '@qwedqwed/axios' installed or running should be considered fully compromised. Attackers may gain full control, potentially accessing all secrets and keys stored on the system. Removal of the package alone does not guarantee elimination of all malicious artifacts. Immediate secret and key rotation from a separate, trusted system is required to mitigate the impact.

Remove the '@qwedqwed/axios' package immediately if installed. Rotate all secrets and keys stored on the affected system from a different, trusted computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the environment. Avoid installing packages from untrusted or suspicious scopes, and verify package authenticity before installation.