[Mustaqeem-Rafi]

No description provided.

[github-actions]

🔴 Preflight: BLOCK — Dependency Update Intercepted

axios 1.7.9 → 1.7.10 · Confidence: 94% · 2.84s

Pattern matches known supply chain attack: new postinstall hook with outbound network call combined with provenance removal after inactivity is high-confidence malicious.

Signal	Status	Detail
Script diff	🚨 Flagged	New postinstall hook added in 1.7.10
AST scan	🚨 Flagged	Postinstall opens outbound HTTP connection exfiltrating process.env
Maintainer	🚨 Flagged	Provenance attestation removed after 8 months of inactivity
Gemini AI	🚨 Flagged	Pattern matches known supply chain attack: new postinstall hook with outbound network call combined with provenance removal after inactivity is high-confidence malicious

Attack pattern: npm_account_hijack_rat_deployment

❌ Do NOT merge · 🔍 Review manually · 📢 Report to npm security

Preflight · View full analysis →