@cyberhub/trust-axios 1.0.2 → 1.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +19 -47
  2. package/package.json +2 -2
package/README.md CHANGED
@@ -1,8 +1,8 @@
1
1
  # Security Trust Report: axios
2
2
 
3
- **axios@1.14.0: 62/100 | Grade: C+ | Tier: STANDARD** (confidence: ±3)
3
+ **[axios@1.14.0](https://www.npmjs.com/package/axios): 64/100 | Grade: C+ | Tier: STANDARD** (confidence: ±3)
4
4
 
5
- > Data verified on 2026-04-02 from 8 security databases.
5
+ > Scanned on 2026-04-03 from 8 security databases. [View package on npm →](https://www.npmjs.com/package/axios)
6
6
 
7
7
  ## TL;DR
8
8
 
@@ -19,14 +19,14 @@ CVE-2023-45857: CSRF token theft via cookie exposure. CVE-2024-28849: SSRF vulne
19
19
  ```
20
20
  Maintainer Trust: ████████████████░░░░ 80/100
21
21
  Package Health: ██████████████████░░ 89/100
22
- Supply Chain: ████░░░░░░░░░░░░░░░░ 19/100
22
+ Supply Chain: █████░░░░░░░░░░░░░░░ 26/100
23
23
  Community: ██████████░░░░░░░░░░ 48/100
24
24
  ```
25
25
 
26
26
  ### Why this score?
27
27
 
28
- - Supply Chain is 19 because: 1 known CVEs, in breach database, risky dependencies
29
- - Community is 48 because: no GitHub repo found
28
+ - Supply Chain is 26 because: 1 known CVEs, in breach database, risky dependencies
29
+ - Community is 48 because: no public GitHub repo linked (may be private or on another platform)
30
30
 
31
31
  ## Vulnerabilities (1 vulnerability)
32
32
 
@@ -39,65 +39,37 @@ Community: ██████████░░░░░░░░░░
39
39
 
40
40
  ## Key Risk Flags
41
41
 
42
- - 🔴 **CRITICAL**: RECENT-ISH BREACH: CSRF token theft CVE-2023-45857, SSRF via follow-redirects dependency CVE-2024-28849 (2023-2024)
43
- - 🔴 **CRITICAL**: 1 CRITICAL vulnerability(ies) from live CVE databases
42
+ - 🔴 **CRITICAL**: RECENT-ISH BREACH: CSRF token theft CVE-2023-45857, SSRF via follow-redirects dependency CVE-2024-28849 (2023-2024) ([evidence](https://nvd.nist.gov/vuln/detail/CVE-2023-45857))
43
+ - 🔴 **CRITICAL**: 1 CRITICAL vulnerability from live CVE databases
44
44
  - 🟠 **HIGH**: 1 direct dependencies have known security issues
45
- - 🟠 **HIGH**: Depends on "follow-redirects" which has SSRF CVE-2024-28849
46
45
 
47
46
  ## 🛠️ What Should You Do?
48
47
 
49
48
  **Immediate:**
50
49
  - Upgrade to the latest version (`npm update axios`)
51
- - Review the security incident details above
52
- - Consider replacing with [got](https://nrupak.com/trust/got)
50
+ - Or replace with [got](https://nrupak.com/trust/got)
53
51
 
54
- **Always:**
55
- - Pin exact version: `"axios": "1.14.0"`
56
- - Run `pkgtrust scan` in your CI pipeline
57
- - Monitor: [nrupak.com/trust/axios](https://nrupak.com/trust/axios)
52
+ **Always:** Pin version, run `pkgtrust scan` in CI, monitor at [nrupak.com/trust/axios](https://nrupak.com/trust/axios)
58
53
 
59
54
  ## 🔄 Safer Alternatives
60
55
 
61
- | Package | Why | Trust Report |
62
- |---------|-----|-------------|
63
- | **got** | No known breaches, better error handling | [View score](https://nrupak.com/trust/got) |
64
- | **node-fetch** | Lightweight, fewer dependencies | [View score](https://nrupak.com/trust/node-fetch) |
65
- | **undici** | Node.js built-in HTTP client (Node 18+) | [View score](https://nrupak.com/trust/undici) |
56
+ | Package | Why | npm | Trust Score |
57
+ |---------|-----|-----|-------------|
58
+ | **got** | No known breaches, better error handling | [npm](https://www.npmjs.com/package/got) | [View score](https://nrupak.com/trust/got) |
59
+ | **node-fetch** | Lightweight, fewer dependencies | [npm](https://www.npmjs.com/package/node-fetch) | [View score](https://nrupak.com/trust/node-fetch) |
60
+ | **undici** | Node.js built-in HTTP client (Node 18+) | [npm](https://www.npmjs.com/package/undici) | [View score](https://nrupak.com/trust/undici) |
66
61
 
67
- ## Maintainers
62
+ ## Maintainers (1)
68
63
 
69
- - **jasonsaayman** ✅ 2FA enabled (org email)
64
+ - [jasonsaayman](https://www.npmjs.com/~jasonsaayman) ✅ 2FA (org email) — [Trust profile](https://nrupak.com/trust/maintainer/jasonsaayman)
70
65
 
71
- ## Methodology
72
-
73
- This score is computed from **18+ signals** across **4 categories**:
74
- - **Maintainer Trust (35%)**: Account age, 2FA, publish cadence, maintainer changes, email domain
75
- - **Package Health (25%)**: Install scripts, dependency count, license, provenance, size changes, code quality
76
- - **Supply Chain (25%)**: Live CVEs from 8 databases, known breaches, typosquatting, transitive risk
77
- - **Community (15%)**: GitHub stars, contributors, CI, OpenSSF Scorecard, npms.io quality
78
-
79
- [Full scoring methodology →](https://nrupak.com/trust)
80
-
81
- ## Check Your Project
82
-
83
- ```bash
84
- # Install pkgtrust
85
- npm install -g @cyberhub/pkgtrust
86
-
87
- # Scan a specific package
88
- pkgtrust scan axios
89
-
90
- # Scan all your dependencies
91
- pkgtrust scan
92
-
93
- # Compare alternatives
94
- pkgtrust compare axios got node-fetch
95
- ```
66
+ **Methodology:** 18+ signals across 4 categories (Maintainer 35%, Package 25%, Supply Chain 25%, Community 15%). [Full scoring docs →](https://nrupak.com/trust)
96
67
 
68
+ **Check your project:** `npm i -g @cyberhub/pkgtrust && pkgtrust scan axios` — [CLI docs](https://npmjs.com/package/@cyberhub/pkgtrust)
97
69
  **Data Sources:** GitHub Advisories · OSV.dev · npm audit · Snyk · Socket.dev · npms.io · Bundlephobia · deps.dev
98
70
 
99
71
  ---
100
72
 
101
73
  *Report by [pkgtrust](https://nrupak.com/trust/axios) · [Dashboard](https://nrupak.com/trust) · [Compare](https://nrupak.com/trust/compare) · [CLI](https://npmjs.com/package/@cyberhub/pkgtrust)*
102
74
 
103
- *This is an automated security report. Not affiliated with the axios team. Updated 2026-04-02.*
75
+ *This is an automated security report. Not affiliated with the axios team. Updated 2026-04-03.*
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@cyberhub/trust-axios",
3
- "version": "1.0.2",
4
- "description": "Security Trust Report: axios@1.14.0 — 62/100 (C+, standard). 1 vulnerability found. Maintainer risk, supply chain analysis from 8 security databases.",
3
+ "version": "1.0.4",
4
+ "description": "Security Trust Report: axios@1.14.0 — 64/100 (C+, standard). 1 vulnerability found. Maintainer risk, supply chain analysis from 8 security databases.",
5
5
  "keywords": [
6
6
  "axios",
7
7
  "axios",