npmjs.com/package/axios · 1.20.0+
90/ 100
No threats observedNo threats observed: The observed install and entry run completed with full coverage and no deductions. Scanned 23 Oct 2026.
NetworkRegistry only
Registry traffic only
CodeNothing taken off
no code deduction
Score
90 / 1001000
Nothing was taken off for what the code did or what running it showed.
What it did
88 events in 19.1sFetched0.3s
554708 bytes
Checked0.5s
0 locked dependencies, 0 malicious
Read11.7s
3 scanner finding(s)
Jev15.2s
Answered questions from the evidence
Sandbox15.2s
install completed, entry completed, 54 forged call(s)
Score15.7s
90 No threats observed
Network
nothing real left the machineAForged dns
registry.npmjs.org
0 B sent in install
AAAAForged dns
registry.npmjs.org
0 B sent in install
GETForged registry
registry.npmjs.org/follow-redirects
0 B sent in install
GETForged registry
registry.npmjs.org/form-data
0 B sent in install
GETForged registry
registry.npmjs.org/https-proxy-agent
0 B sent in install
GETForged registry
registry.npmjs.org/proxy-from-env
0 B sent in install
Show all 54 calls
GETForged registry
registry.npmjs.org/hasown
0 B sent in install
GETForged registry
registry.npmjs.org/asynckit
0 B sent in install
GETForged registry
registry.npmjs.org/mime-types
0 B sent in install
GETForged registry
registry.npmjs.org/combined-stream
0 B sent in install
GETForged registry
registry.npmjs.org/es-set-tostringtag
0 B sent in install
GETForged registry
registry.npmjs.org/debug
0 B sent in install
GETForged registry
registry.npmjs.org/agent-base
0 B sent in install
GETForged registry
registry.npmjs.org/delayed-stream
0 B sent in install
GETForged registry
registry.npmjs.org/es-errors
0 B sent in install
GETForged registry
registry.npmjs.org/get-intrinsic
0 B sent in install
GETForged registry
registry.npmjs.org/has-tostringtag
0 B sent in install
GETForged registry
registry.npmjs.org/function-bind
0 B sent in install
GETForged registry
registry.npmjs.org/mime-db
0 B sent in install
GETForged registry
registry.npmjs.org/gopd
0 B sent in install
GETForged registry
registry.npmjs.org/get-proto
0 B sent in install
GETForged registry
registry.npmjs.org/has-symbols
0 B sent in install
GETForged registry
registry.npmjs.org/es-object-atoms
0 B sent in install
GETForged registry
registry.npmjs.org/math-intrinsics
0 B sent in install
GETForged registry
registry.npmjs.org/es-define-property
0 B sent in install
GETForged registry
registry.npmjs.org/call-bind-apply-helpers
0 B sent in install
GETForged registry
registry.npmjs.org/dunder-proto
0 B sent in install
GETForged registry
registry.npmjs.org/ms
0 B sent in install
GETForged registry
registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/delayed-stream/-/…ayed-stream-1.0.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/debug/-/debug-4.4.3.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/ms/-/ms-2.1.3.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/math-intrinsics/-…-intrinsics-1.1.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/es-object-atoms/-…bject-atoms-1.1.2.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/has-tostringtag/-…tostringtag-1.0.2.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/hasown/-/hasown-2.0.4.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/gopd/-/gopd-1.2.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/call-bind-apply-h…ply-helpers-1.0.2.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/es-define-propert…ne-property-1.0.1.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/es-set-tostringta…tostringtag-2.1.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/combined-stream/-…ined-stream-1.0.8.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/proxy-from-env/-/…xy-from-env-2.1.0.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/form-data/-/form-data-4.0.6.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/https-proxy-agent…proxy-agent-5.0.1.tgz
0 B sent in install
GETForged registry
registry.npmjs.org/follow-redirects/…-redirects-1.16.1.tgz
0 B sent in install
Luna's report
No deductions were recorded in the observed run or code review. Pin the scanned version. Behaviour outside the observed install and entry windows was not verified.
We installed the package and ran its entry point in a throwaway sandbox, and scanned the reachable code. The run completed with full coverage and no deductions.
What it ran
Installednpm · 27 packages · 4.6s
Entry pointenv -i HOME=/hom…T=1 FAKETIME_NO_CAC
NetworkRegistry only
MachineDestroyed after the scan
Jev's answers
answered from the evidenceInstall check
Install-time code uses the network
Install-time code does not read credentials
Show all 5 answers
Install-time code runs other programs or payloads
Install-time code is not obfuscated
Jev judged this code harmless
package.jsonDocs check
The docs do not say it makes no network calls
The docs do not say it has no side effects
Show all 3 answers
What it did fits what its docs say it is for
Flagged code check
Jev judged this code harmless
Not verified
Behaviour outside the observed install and entry windows
Code paths not triggered by install or the entry point
Show all 3 items
Payloads gated on calendar dates past the accelerated clock window, or on hosts that need real responses
Reputation
npmWeekly npm downloads: 66557149
npmFirst npm publish: 4437 days ago
npmNo maintainer change within 30 days
npmFirst published 12 years ago
npmnpm maintainers: jasonsaayman
npm67M weekly downloads
Shown apart from the code and behaviour findings.