MAL-2026-18433: Malicious code in @axon-web/icons (npm)

Published Nov 1, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ee650ff91eeb70cc76f880c6b66b586b21c471c95eac22a9e23160aaffa45a58) The package is advertised as an SVG icon library but, on require, runs an IIFE that constructs an identifier from os.hostname() and process.env.USER/USERNAME and issues a DNS resolve against a subdomain of nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun — an interactsh-style out-of-band interaction collector. The hostname and username of the installing machine are leaked to a non-first-party DNS endpoint over outbound DNS, bypassing HTTP egress controls. The same import-time code enumerates process.env keys matching /token|secret|key|pass|aws|github|npm/i and prints the matching names alongside hostname, user, cwd, and Node version. No icon-library functionality justifies DNS beaconing or credential-name enumeration, and the host identity is sent to a destination the caller did not configure.

Affected Software

1 affected component

npm/@axon-web/icons=99.0.0, =2.0.0

Event History

Nov 1, 2026

Advisory Published

via OSV·08:02 AM

Data Sourced

via OSV·08:02 AM

DescriptionAffected Software

Frequently Asked Questions

What systems are exposed to the DNS beaconing?

Any machine that requires or imports the package is exposed, because the code runs on require. The package constructs an identifier from the host name and USER or USERNAME environment variable and sends it through a DNS lookup to an external domain.

What information does the package collect locally?

It uses the machine hostname and USER or USERNAME value for the DNS request. It also enumerates environment-variable names matching token, secret, key, pass, aws, github, or npm and prints those names along with the hostname, user, current working directory, and Node version.

Does exploitation require credentials or a special application configuration?

No special configuration or credentials are described. The behavior is triggered when the package is required or imported, and outbound DNS is sufficient for the host identifier to reach the external collector.

How can I check whether an environment may have been affected?

Check dependency manifests, lockfiles, and installed npm packages for @axon-web/icons, including the referenced 2.0.0 and 99.0.0 releases. Review DNS telemetry for queries to subdomains of nxsqlpejfpamagxctjyv4c9qj1gfdtzwi.oast.fun from systems that may have loaded the package.

MAL-2026-18433: Malicious code in @axon-web/icons (npm)

Affected Software

Event History

Frequently Asked Questions

What systems are exposed to the DNS beaconing?

What information does the package collect locally?

Does exploitation require credentials or a special application configuration?

How can I check whether an environment may have been affected?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to the DNS beaconing?

What information does the package collect locally?

Does exploitation require credentials or a special application configuration?

How can I check whether an environment may have been affected?