mkdir -p /workspace/axios-forensics/{registry,tarballs,extracted,analysis} && echo "workspace ready"

workspace ready

cd /workspace/axios-forensics && curl -s https://registry.npmjs.org/axios | python3 -c "
import json, sys
data = json.load(sys.stdin)
versions = data.get('versions', {})
time_data = data.get('time', {})
dist_tags = data.get('dist-tags', {})

print('=== DIST-TAGS ===')
for tag, ver in dist_tags.items():
    print(f'  {tag}: {ver}')

print()
print('=== RECENT VERSIONS (last 10 publish times) ===')
sorted_times = sorted([(k,v) for k,v in time_data.items() if k not in ('created','modified')], key=lambda x: x[1], reverse=True)
for ver, ts in sorted_times[:10]:
    print(f'  {ver}: {ts}')

print()
print('=== axios@1.14.0 maintainers/published-by ===')
v1140 = versions.get('1.14.0', {})

import json, sys
data = json.load(sys.stdin)
versions = data.get('versions', {})
time_data = data.get('time', {})
dist_tags = data.get('dist-tags', {})

cd /workspace/axios-forensics && curl -s https://registry.npmjs.org/plain-crypto-js | python3 -c "
import json, sys
data = json.load(sys.stdin)
versions = data.get('versions', {})
time_data = data.get('time', {})
dist_tags = data.get('dist-tags', {})

print('=== plain-crypto-js DIST-TAGS ===')
for tag, ver in dist_tags.items():
    print(f'  {tag}: {ver}')

print()
print('=== ALL VERSIONS + PUBLISH TIMES ===')
for ver, ts in sorted(time_data.items()):
    print(f'  {ver}: {ts}')

print()
for v in versions:
    vdata = versions[v]
    print(f'=== plain-crypto-js@{v} ===')

import json, sys
data = json.load(sys.stdin)
versions = data.get('versions', {})
time_data = data.get('time', {})
dist_tags = data.get('dist-tags', {})

cd /workspace/axios-forensics/tarballs && \
curl -s -o plain-crypto-js-4.2.0.tgz https://registry.npmjs.org/plain-crypto-js/-/plain-crypto-js-4.2.0.tgz && \
curl -s -o plain-crypto-js-4.2.1.tgz https://registry.npmjs.org/plain-crypto-js/-/plain-crypto-js-4.2.1.tgz && \
curl -s -o axios-1.14.0.tgz https://registry.npmjs.org/axios/-/axios-1.14.0.tgz && \
curl -s -o axios-1.14.1.tgz https://registry.npmjs.org/axios/-/axios-1.14.1.tgz && \
curl -s -o axios-0.30.3.tgz https://registry.npmjs.org/axios/-/axios-0.30.3.tgz && \
curl -s -o axios-0.30.4.tgz https://registry.npmjs.org/axios/-/axios-0.30.4.tgz && \
echo "DOWNLOADS DONE:" && ls -lh *.tgz

curl -s -o plain-crypto-js-4.2.0.tgz https://registry.npmjs.org/plain-crypto-js/-/plain-crypto-js-4.2.0.tgz && \
curl -s -o plain-crypto-js-4.2.1.tgz https://registry.npmjs.org/plain-crypto-js/-/plain-crypto-js-4.2.1.tgz && \
curl -s -o axios-1.14.0.tgz https://registry.npmjs.org/axios/-/axios-1.14.0.tgz && \
curl -s -o axios-1.14.1.tgz https://registry.npmjs.org/axios/-/axios-1.14.1.tgz && \
curl -s -o axios-0.30.3.tgz https://registry.npmjs.org/axios/-/axios-0.30.3.tgz && \
curl -s -o axios-0.30.4.tgz https://registry.npmjs.org/axios/-/axios-0.30.4.tgz && \

cd /workspace/axios-forensics && \
mkdir -p extracted/{plain-crypto-js-4.2.0,plain-crypto-js-4.2.1,axios-1.14.0,axios-1.14.1,axios-0.30.3,axios-0.30.4} && \
for pkg in plain-crypto-js-4.2.0 plain-crypto-js-4.2.1 axios-1.14.0 axios-1.14.1 axios-0.30.3 axios-0.30.4; do
  tar -xzf tarballs/${pkg}.tgz -C extracted/${pkg}/ 2>&1 && echo "extracted: ${pkg}"
done

mkdir -p extracted/{plain-crypto-js-4.2.0,plain-crypto-js-4.2.1,axios-1.14.0,axios-1.14.1,axios-0.30.3,axios-0.30.4} && \
for pkg in plain-crypto-js-4.2.0 plain-crypto-js-4.2.1 axios-1.14.0 axios-1.14.1 axios-0.30.3 axios-0.30.4; do
  tar -xzf tarballs/${pkg}.tgz -C extracted/${pkg}/ 2>&1 && echo "extracted: ${pkg}"
done
extracted: plain-crypto-js-4.2.0
extracted: plain-crypto-js-4.2.1

cd /workspace/axios-forensics && echo "=== plain-crypto-js-4.2.1 FILE LISTING ===" && find extracted/plain-crypto-js-4.2.1 -type f | sort && echo "" && echo "=== plain-crypto-js-4.2.0 FILE LISTING ===" && find extracted/plain-crypto-js-4.2.0 -type f | sort

=== plain-crypto-js-4.2.1 FILE LISTING ===
extracted/plain-crypto-js-4.2.1/package/CONTRIBUTING.md
extracted/plain-crypto-js-4.2.1/package/LICENSE
extracted/plain-crypto-js-4.2.1/package/README.md
extracted/plain-crypto-js-4.2.1/package/aes.js
extracted/plain-crypto-js-4.2.1/package/blowfish.js

import base64
import json

# The stq array from setup.js
stq = [
    "_kLx+SMqE7KxlS8vE3LxSScqEHKxjScpE7Kx",
    "__gvELKx",
    "__gvEvKx",
    "iWsuF3bx9WctFDbxgSsoE7KxjWspEvKxhSsrE/LxsSsvELaxiW8tF3Lx+ScuEXKx",
    "",
    "__wvF7bxkSMpErLx",
    "jSMpErLx4SMrEnKx",
    "_oaxtWcrF3axHWMqEnLxhSMrEvIxqWcoF3bxtWcoF/axsSsoF3axvWMqFXIxZSMjE3JxSScmE3JxvW8rFraxhSMqEnKxtW8qFraxvW8rFbIxESMhEHIxSS8nE7IxZS8rF/axtWMqF/axFScmEzIxdSclE7JxdS8rFjaxtWMqEHKxkS8qEfaxtWsvE7LxrScvETLxvScrF3LxvSMoF3axjS8rEnKxpSMpEXKxtWcvEDaxtW8rFjaxUS8nEzIxDSMhEjIxSSsnE3JxoW8rF3axrWcrF/axoWchEnJxMSsmELJxeScnE/axvWsqFPbxtW8rFjaxGS8gETIxBSskEjJxOSsnE/axoWcrF/axvWMvFnLxpSMuEnKxiSMuE3LxiWsqE/LxiSMpFDKx9S8oETax+SMqErKxsSspEnKxsScvE/axoWcrFnKxgWcrFnJxZSsgE3JxtWskEDaxtWsvEDaxtWspE/Lx4SsrEraxuSsoF3axoSctE/KxjWcqEDKxpS8rF3axjSMuE/JxkWcoEHKxoSsoE7JxnS8rELKxtWsqF3axtW8hFPaxvWcoEHKxoScpEnJxjWcuE3LxjS8vE7KxeSsmE/axiWcuE7KxoSMoE/KxCSMqEnLxsS8rE/LxOScrFfbxtWcoEHKxoScpEnJxnS8rELKxqWcuEjKxeScrF3axqWcrFfYx",
    "_sKxiWcrFjaxFScmEzIxdSskEbIxMSsjELIxGS8rF3axhSMqEnKxqW8qFvaxtWcpErKxiScoELKxjScpFLaxtW8rFLIxZSMjE3JxSScgEvIxOSsgEHIxoWcrFnLx9SMpE/LxpSsvE7Kx",
    "__wrFLIxZSMjE3JxSScgEvIxOSsgEHIxqW8qE/LxgWcrFDKx4S8rF3ax5SsuETKx/SsrE7LxtWspEHKxoScpEnLxtWsoEnKxtWcrFraxtW8hFTLx4ScuE3axpS8oEjKxqWcrF3axtWsqF3axtWcrFfYxvWspEHKx4S8oEXax7SMqEnKxiWcrFTbxrWcrF/axWS8qF3axvWcrFvaxqWsvE3axrWsqF/axtW8rF3axrWsqFnKxtW8qFraxvW8rFHJxtWsrEfaxtWcpE7LxwSsoFPKxkS8rELaxqW8qFvaxtWMqF3axrWcrFnKxtWMrF3axvWcrFrbx6WsuF3axpSsoEfKxlSsrE3axsW8qF3axvWcrFvaxqWsvE3axrWsqF/axtWsvEDaxtWMqF3axrWcrFjax9WcuE7Kx4ScqEXKx/ScvELaxtS8vELKxjWMoE3LxkS8oF7LxoScrEzKxmSsrEzKx9SsqFnKxgWcrFjaxtW8qF3axsScrFzaxtWcqE3axsWcrF/axtWsoEDaxqWcoE/Lx4ScqE/axtWcuE3LxkSMuE7Kx+ScrFbKxhSMqEXKx+ScrFXKxpScrF3axqWcrF3axtWcrF3axqWcrF3axtWMgFTLx/ScuE3axtWsqF3axtWcrFraxtW8hFDLxvWcqETKxiSMoEPax+SsrEzKxjWMqEHKx6ScvEzKxjW8pELKxuSsoF7LxoSsoE7KxsSsjEXax0S8vEzKx/S8rEPKxBSsoF/axqWcoF/axGS8gETIxGSskE/JxOScmE/axtWcoF/axvWcsE3axiScuEraxwScqE3axhWsvEraxhWMrEbLxqWcuEjKx+ScrF3axqWcrFfYx",
    "__wqF3ax8W8qFTbx/WcrFHKxmSMuEPKxiW8uEjKxuSsoF3axzWsqF/axFScmEzIxdSclEHIxMSsjEXIxBS8rF3ax5ScvEPKx/SsrE7LxrSsvELKxtWcvEjLxiSsoEPKx",
    "",
    "_saxtW8uFvaxzW8vFraxhScoEjLxjSsoFzLxoScqELaxqW8sF3axGS8gETIxGSskE/JxOScmE3ax0ScvEPaxpSspELax9SMoE7LxiWcrF7bxjSsoELKx5SMtE3LxqWcvEjLxlSsoEPKxqW8qFvaxtWcgEPIxEScgELJxfSciE7JxtWsvEfaxtW8vFnLxuSMuE7KxiS8vE3LxlWsqE/LxiS8oFDKx6S8oEPax+S8rErKxsSspE7KxsSsuE3axpSMoFrax0ScvEPaxpScoEXax9SMoEnLxlWcrFLKxgWcrFHKx4SMuE7Kx",
    "jSsoE7LxgS8oFjKxqSMrEbKxpSMrE3Lx",
    "_kKxnS8oFjKxqSMrEbKxpSMrE3Lx",

=== DECODED STQ STRINGS ===
stq[ 0]: 'child_process'
stq[ 1]: 'os'
stq[ 2]: 'fs'
stq[ 3]: 'http://sfrclak.com:8000/'
stq[ 4]: (empty)

import base64

# Decode the atob() inline variables from _entry()
def atob(s):
    # Replace padding-substitute chars and decode
    return base64.b64decode(s + '==').decode('utf-8', errors='replace').rstrip('\x00')

# From the code:
# E = atob("TE9DQUw^".replaceAll("^","=")) + atob("X1BBVEg^".replaceAll("^","="))
E = base64.b64decode("TE9DQUw=").decode() + base64.b64decode("X1BBVEg=").decode()

# S = atob("UFM_".replaceAll("_","=")) + atob("X1BBVEg_".replaceAll("_","="))
S = base64.b64decode("UFS=").decode() + base64.b64decode("X1BBVEg=").decode()
# Wait, "UFM_" -> "UFM=" -> base64 decode
S = base64.b64decode("UFM=").decode() + base64.b64decode("X1BBVEg=").decode()

# a = atob("U0NSXw--".replaceAll("-","=")) + atob("TElOSw))".replaceAll(")","="))
a = base64.b64decode("U0NSXw==").decode() + base64.b64decode("TElOSw==").decode()

# c = atob("UFNfQg--".replaceAll("-","=")) + atob("SU5BUlk*".replaceAll("*","="))

Variable substitution map:
  E (LOCAL_PATH placeholder) = 'LOCAL_PATH'
  S (PS_PATH placeholder)    = 'PS_PATH'
  a (SCR_LINK placeholder)   = 'SCR_LINK'
  c (PS_BINARY placeholder)  = 'PS_BINARY'
  s (shell cmd find PS)      = 'where powershell'

cd /workspace/axios-forensics && echo "=== DIFF: axios 1.14.0 vs 1.14.1 package.json ===" && diff \
  extracted/axios-1.14.0/package/package.json \
  extracted/axios-1.14.1/package/package.json

echo ""
echo "=== DIFF: axios 0.30.3 vs 0.30.4 package.json ===" && diff \
  extracted/axios-0.30.3/package/package.json \
  extracted/axios-0.30.4/package/package.json

extracted/axios-1.14.0/package/package.json \
  extracted/axios-1.14.1/package/package.json
=== DIFF: axios 1.14.0 vs 1.14.1 package.json ===
3c3
<   "version": "1.14.0",
---

cd /workspace/axios-forensics && echo "=== FULL FILE DIFF axios 1.14.0 vs 1.14.1 (all files) ===" && diff -rq \
  extracted/axios-1.14.0/package/ \
  extracted/axios-1.14.1/package/ 2>&1

echo ""
echo "=== FULL FILE DIFF axios 0.30.3 vs 0.30.4 (all files) ===" && diff -rq \
  extracted/axios-0.30.3/package/ \
  extracted/axios-0.30.4/package/ 2>&1

extracted/axios-1.14.0/package/ \
  extracted/axios-1.14.1/package/ 2>&1
=== FULL FILE DIFF axios 1.14.0 vs 1.14.1 (all files) ===

Files extracted/axios-1.14.0/package/package.json and extracted/axios-1.14.1/package/package.json differ

cd /workspace/axios-forensics && echo "=== plain-crypto-js 4.2.0 vs 4.2.1 diff ==="
diff -rq extracted/plain-crypto-js-4.2.0/package/ extracted/plain-crypto-js-4.2.1/package/ 2>&1

echo ""
echo "=== package.json (MALICIOUS - 4.2.1 with postinstall) ==="
cat extracted/plain-crypto-js-4.2.1/package/package.json

echo ""
echo "=== package.md (CLEAN DECOY - what replaces package.json post-execution) ==="
cat extracted/plain-crypto-js-4.2.1/package/package.md

echo ""
echo "=== package.json (4.2.0 - no postinstall) ==="
cat extracted/plain-crypto-js-4.2.0/package/package.json

=== plain-crypto-js 4.2.0 vs 4.2.1 diff ===
Files extracted/plain-crypto-js-4.2.0/package/package.json and extracted/plain-crypto-js-4.2.1/package/package.json differ
Only in extracted/plain-crypto-js-4.2.1/package/: package.md
Only in extracted/plain-crypto-js-4.2.1/package/: setup.js

echo "=== WHOIS: sfrclak.com ===" && whois sfrclak.com 2>&1 | head -60
echo ""
echo "=== DNS RECORDS: sfrclak.com ===" && dig sfrclak.com ANY +noall +answer 2>&1
echo "" && dig sfrclak.com A +short 2>&1
echo "" && dig sfrclak.com MX +short 2>&1
echo "" && dig sfrclak.com NS +short 2>&1

=== WHOIS: sfrclak.com ===

   Domain Name: SFRCLAK.COM
   Registry Domain ID: 3082352565_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.namecheap.com
   Registrar URL: http://www.namecheap.com

echo "=== IP INTEL: 142.11.206.73 ===" && curl -s https://ipinfo.io/142.11.206.73/json 2>&1
echo ""
echo "=== REVERSE DNS ===" && dig -x 142.11.206.73 +short 2>&1
echo ""
echo "=== WHOIS IP ===" && whois 142.11.206.73 2>&1 | grep -E "(NetName|OrgName|Country|CIDR|Organization|descr|inetnum|netname|address|aut-num)" | head -20

=== IP INTEL: 142.11.206.73 ===

{
  "ip": "142.11.206.73",
  "hostname": "client-142-11-206-73.hostwindsdns.com",
  "city": "Dallas",

# Check npm download stats for the compromised packages
echo "=== npm downloads: axios (last week) ==="
curl -s "https://api.npmjs.org/downloads/point/last-week/axios" 2>&1

echo ""
echo "=== npm downloads: plain-crypto-js (last month) ==="
curl -s "https://api.npmjs.org/downloads/point/last-month/plain-crypto-js" 2>&1

echo ""
echo "=== npm downloads: axios last-day ==="
curl -s "https://api.npmjs.org/downloads/point/last-day/axios" 2>&1

echo ""
echo "=== npm downloads: axios by version range (since compromise) ==="
curl -s "https://api.npmjs.org/downloads/range/2026-03-31:2026-03-31/axios" 2>&1

=== npm downloads: axios (last week) ===

{"downloads":100340121,"start":"2026-03-23","end":"2026-03-29","package":"axios"}[STRIX_0]$

=== npm downloads: plain-crypto-js (last month) ===
{"error":"package plain-crypto-js not found"}[STRIX_0]$

# Check GitHub API for axios releases and commits - no auth needed for public data
echo "=== GitHub: axios recent releases ==="
curl -s "https://api.github.com/repos/axios/axios/releases?per_page=5" 2>&1 | python3 -c "
import json, sys
data = json.load(sys.stdin)
for r in data:
    print(f'  tag: {r[\"tag_name\"]}  published: {r[\"published_at\"]}  draft: {r[\"draft\"]}  prerelease: {r[\"prerelease\"]}')
    print(f'  name: {r[\"name\"]}')
    print()
"

echo ""
echo "=== GitHub: axios recent tags ==="
curl -s "https://api.github.com/repos/axios/axios/tags?per_page=10" 2>&1 | python3 -c "
import json, sys
data = json.load(sys.stdin)
for t in data:
    print(f'  tag: {t[\"name\"]}  sha: {t[\"commit\"][\"sha\"]}')
"

=== GitHub: axios recent releases ===
import json, sys
data = json.load(sys.stdin)
for r in data:
    print(f'  tag: {r[\"tag_name\"]}  published: {r[\"published_at\"]}  draft: {r[\"draft\"]}  prerelease: {r[\"prerelease\"]}')
    print(f'  name: {r[\"name\"]}')

# Look at DigitalBrainJS "deprecate action" commit - possible team response to incident
echo "=== Commit: e2bed7f84d86 (2026-03-31 01:42 - 'add deprecate action') ==="
curl -s "https://api.github.com/repos/axios/axios/commits/e2bed7f84d86e2bed7f84d86e2bed7f84d86e2bed7f84d86" 2>&1 | python3 -c "
import json, sys
try:
    d = json.load(sys.stdin)
    print(d.get('message','not found'))
except: print('error')
"

curl -s "https://api.github.com/repos/axios/axios/commits/e2bed7f84d86" 2>&1 | python3 -c "
import json, sys
d = json.load(sys.stdin)
c = d.get('commit',{})
print('Message:', c.get('message',''))
print('Date:', c.get('author',{}).get('date',''))
files = d.get('files', [])
print('Files changed:')
for f in files:
    print(f'  {f[\"status\"]:10} {f[\"filename\"]}')

=== Commit: e2bed7f84d86 (2026-03-31 01:42 - 'add deprecate action') ===
import json, sys
try:
    d = json.load(sys.stdin)
    print(d.get('message','not found'))
except: print('error')

# Get full deprecate.yml workflow
echo "=== Full deprecate.yml ==="
curl -s "https://raw.githubusercontent.com/axios/axios/main/.github/workflows/deprecate.yml" 2>&1

echo ""
# Also check if there's an existing npm publish workflow to understand the OIDC setup
echo "=== npm publish workflow (to compare OIDC) ==="
curl -s "https://raw.githubusercontent.com/axios/axios/main/.github/workflows/release.yml" 2>&1 | head -60

=== Full deprecate.yml ===

404: Not Found[STRIX_0]$

=== npm publish workflow (to compare OIDC) ===
404: Not Found[STRIX_0]$

Error executing terminal_execute: Sandbox execution error: Unexpected error: terminal_execute() missing 1 required positional argument: 'command'

echo "=== List GitHub Actions workflows ===" && curl -s "https://api.github.com/repos/axios/axios/contents/.github/workflows" 2>&1 | python3 -c "
import json, sys
try:
    data = json.load(sys.stdin)
    if isinstance(data, list):
        for f in data:
            print(f'  {f[\"name\"]:40} {f[\"sha\"]}')
    else:
        print(data)
except Exception as e:
    print('Error:', e)
"
echo ""
echo "=== SHA256 checksums of all tarballs ===" && sha256sum /workspace/axios-forensics/tarballs/*.tgz
echo ""
echo "=== SHA1 for registry verification ===" && sha1sum /workspace/axios-forensics/tarballs/*.tgz

import json, sys
try:
    data = json.load(sys.stdin)
    if isinstance(data, list):
        for f in data:
            print(f'  {f[\"name\"]:40} {f[\"sha\"]}')

echo "=== publish.yml (OIDC trusted publisher setup) ===" && curl -s "https://api.github.com/repos/axios/axios/contents/.github/workflows/publish.yml" 2>&1 | python3 -c "
import json, sys, base64
d = json.load(sys.stdin)
print(base64.b64decode(d['content']).decode())
"

import json, sys, base64
d = json.load(sys.stdin)
print(base64.b64decode(d['content']).decode())
"
=== publish.yml (OIDC trusted publisher setup) ===
name: Publish package to NPM

# Check nrwise account on npm registry
echo "=== nrwise npm account profile ===" && curl -s "https://registry.npmjs.org/-/npm/v1/user/nrwise" 2>&1

echo ""
echo "=== packages owned by nrwise ===" && curl -s "https://registry.npmjs.org/-/v1/search?text=maintainer:nrwise&size=20" 2>&1 | python3 -c "
import json, sys
d = json.load(sys.stdin)
objs = d.get('objects', [])
print(f'Total packages: {d.get(\"total\", 0)}')
for o in objs:
    p = o.get('package', {})
    print(f'  {p.get(\"name\")}  v{p.get(\"version\")}  published: {p.get(\"date\")}')
"

echo ""
echo "=== packages owned by jasonsaayman (to check if account cleaned up) ===" && curl -s "https://registry.npmjs.org/-/v1/search?text=maintainer:jasonsaayman&size=10" 2>&1 | python3 -c "
import json, sys
d = json.load(sys.stdin)
print(f'Total packages: {d.get(\"total\", 0)}')
for o in d.get('objects', []):

=== nrwise npm account profile ===

{"code":"ResourceNotFound","message":"/-/npm/v1/user/nrwise does not exist"}[STRIX_0]$

import json, sys
d = json.load(sys.stdin)

# Check @c8o/nimbus-core for any recent publish or tampering
echo "=== @c8o/nimbus-core registry check ===" && curl -s "https://registry.npmjs.org/%40c8o%2Fnimbus-core" 2>&1 | python3 -c "
import json, sys
d = json.load(sys.stdin)
dist_tags = d.get('dist-tags', {})
time_data = d.get('time', {})
print('dist-tags:', dist_tags)
print('Total versions:', len(d.get('versions', {})))
recent = sorted([(k,v) for k,v in time_data.items() if k not in ('created','modified')], key=lambda x: x[1], reverse=True)
print('Last 5 publishes:')
for v, t in recent[:5]:
    print(f'  {v}: {t}')
"

echo ""
# Check the ssl_hotfix.js commit history - was it suspicious?
echo "=== bin/ssl_hotfix.js history (last 5 commits touching that file) ===" && curl -s "https://api.github.com/repos/axios/axios/commits?path=bin/ssl_hotfix.js&per_page=5" 2>&1 | python3 -c "
import json, sys
data = json.load(sys.stdin)
if isinstance(data, list):

import json, sys
d = json.load(sys.stdin)
dist_tags = d.get('dist-tags', {})
time_data = d.get('time', {})
print('dist-tags:', dist_tags)
print('Total versions:', len(d.get('versions', {})))

# Get the actual content of ssl_hotfix.js from the last version it existed (the Feb 14 commit)
echo "=== bin/ssl_hotfix.js content at ef3711d1b3a3 (Feb 14) ===" && curl -s "https://api.github.com/repos/axios/axios/contents/bin/ssl_hotfix.js?ref=ef3711d1b3a3" 2>&1 | python3 -c "
import json, sys, base64
d = json.load(sys.stdin)
if 'content' in d:
    print(base64.b64decode(d['content']).decode())
else:
    print(d)
"

echo ""
# Also look at the full diff of the 'remove old files' commit to see what ssl_hotfix.js contained
echo "=== ssl_hotfix.js in the removal commit diff ===" && curl -s "https://api.github.com/repos/axios/axios/commits/a7f41f5bb574" 2>&1 | python3 -c "
import json, sys
d = json.load(sys.stdin)
for f in d.get('files', []):
    if 'ssl_hotfix' in f.get('filename', ''):
        print('Filename:', f['filename'])
        print('Status:', f['status'])
        print('Patch:')

import json, sys, base64
d = json.load(sys.stdin)
if 'content' in d:
    print(base64.b64decode(d['content']).decode())
else:
    print(d)

# Compile full threat intelligence picture and IoC list
analysis = """
╔══════════════════════════════════════════════════════════════════════════════════╗
║       AXIOS SUPPLY CHAIN ATTACK — FULL FORENSIC ANALYSIS                      ║
║       Date: 2026-03-31 | Campaign ID: 6202033                                  ║
╚══════════════════════════════════════════════════════════════════════════════════╝

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 1. CONFIRMED LIVE STATUS (as of 03:00 UTC)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  dist-tags on npm:
    latest           →  axios@1.14.1   [COMPROMISED — still live]
    legacy           →  axios@0.30.4   [COMPROMISED — still live]
    next             →  1.7.0-beta.2   [clean]
    old-version      →  0.30.0         [clean]
  
  plain-crypto-js@4.2.1  [COMPROMISED — still live]
  Team response: deprecate.yml committed to axios/axios at 01:42 UTC (40 min after attack)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

╔══════════════════════════════════════════════════════════════════════════════════╗
║       AXIOS SUPPLY CHAIN ATTACK — FULL FORENSIC ANALYSIS                      ║
║       Date: 2026-03-31 | Campaign ID: 6202033                                  ║
╚══════════════════════════════════════════════════════════════════════════════════╝

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

cat > /workspace/axios-forensics/analysis/FULL_FORENSIC_REPORT.md << 'ENDREPORT'
# Axios Supply Chain Attack — Full Forensic Analysis
**Date:** 2026-03-31 | **Campaign ID:** 6202033 | **Status:** ACTIVE — packages still live as of 03:00 UTC

---

## 1. Live Status (confirmed)

| Package | Version | Tag | Status |
|---|---|---|---|
| axios | 1.14.1 | `latest` | **COMPROMISED — still live** |
| axios | 0.30.4 | `legacy` | **COMPROMISED — still live** |
| plain-crypto-js | 4.2.1 | `latest` | **COMPROMISED — still live** |
| axios | 1.14.0 | — | Clean (last good 1.x) |
| axios | 0.30.3 | — | Clean (last good 0.30.x) |

**Team response observed:** `deprecate.yml` committed to `axios/axios` at `2026-03-31T01:42Z` (40 min after attack).

---

# Axios Supply Chain Attack — Full Forensic Analysis
**Date:** 2026-03-31 | **Campaign ID:** 6202033 | **Status:** ACTIVE — packages still live as of 03:00 UTC

---

## 1. Live Status (confirmed)