axios 1.21.0

Source: https://github.com/axios/axios
Artifact scanned: axios-1.21.0.tgz (npm tarball · 610.2 KB · SHA-256 3d34c8aee649…)
Compared with: axios-1.20.0.tgz (6 signals introduced since)
Files: 87 scanned, 3 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 13 info
Scan time: 3.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-28 07:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution dist/axios.js:4035:20 new in this release

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

        // Preserve legacy username bytes unless the caller opts in to UTF-8.
        'Basic ' + btoa((encodeUsername ? encodeUTF8$1(username) : username) + ':' + (password ? encodeUTF8$1(password) : '')));
      } catch (e) {
        throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config);

info long-line dist/axios.js:5133:1 new in this release

line length 959 characters (raw pass, confidence 0.50)

        var _resolveConfig, url, method, data, signal, cancelToken, timeout, onDownloadProgress, onUploadProgress, responseType, headers, _resolveConfig$withCr, withCredentials, fetchOptions, maxContentLength, maxBodyLength, maxRedirects, hasMaxContentLength, hasMaxBodyLength, own, _fetch, composedSignal, request, unsu

info dynamic-execution dist/browser/axios.cjs:3887:11 new in this release

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

        'Basic ' +
          btoa(
            (encodeUsername ? encodeUTF8$1(username) : username) +
              ':' +

info dynamic-execution dist/esm/axios.js:3885:11 new in this release

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

        'Basic ' +
          btoa(
            (encodeUsername ? encodeUTF8$1(username) : username) +
              ':' +

info dynamic-execution dist/node/axios.cjs:5555:18 new in this release

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

      // Preserve legacy username bytes unless the caller opts in to UTF-8.
      'Basic ' + btoa((encodeUsername ? encodeUTF8$1(username) : username) + ':' + (password ? encodeUTF8$1(password) : '')));
    } catch (e) {
      throw AxiosError.from(e, AxiosError.ERR_BAD_OPTION_VALUE, config);

info dynamic-execution lib/helpers/resolveConfig.js:67:11 new in this release

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
        'Basic ' +
          btoa(
            (encodeUsername ? encodeUTF8(username) : username) +
              ':' +
```
info ~~warn~~ → info by review unicode-mixed-script CHANGELOG.md:834:130

identifier `रvan` mixes scripts: Other + Latin (raw pass, confidence 0.80)
```
- <img src="https://avatars.githubusercontent.com/u/47430686?v&#x3D;4&amp;s&#x3D;18" alt="avatar" width="18"/> [shravan || श्रvan](https://github.com/shravan20 '+7/-3 (#6116 )')
```
dismissed LLM, confidence 0.97 A Devanagari-plus-Latin contributor name in a markdown changelog line triggers a mixed-script warning.
Reasoning
The finding is a raw-pass unicode-mixed-script warning on a Devanagari character inside a markdown changelog entry. The text 'श्रvan' is a contributor name rendered in mixed Hindi and Latin script, part of an ordinary GitHub contributor list. It is not an identifier in executable code and has no execution or hiding behavior. Raw-pass findings have a high false-positive rate, and this is a clear one.

info long-line dist/axios.js:5137:1

line length 767 characters (raw pass, confidence 0.50)

              _resolveConfig = resolveConfig(config), url = _resolveConfig.url, method = _resolveConfig.method, data = _resolveConfig.data, signal = _resolveConfig.signal, cancelToken = _resolveConfig.cancelToken, timeout = _resolveConfig.timeout, onDownloadProgress = _resolveConfig.onDownloadProgress, onUploadProgress

info dynamic-execution dist/axios.js:5189:57

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

                headers["delete"]('authorization');
                headers.set('Authorization', 'Basic ' + btoa(encodeUTF8((auth.username || '') + ':' + (auth.password || ''))));
              }

info dynamic-execution dist/browser/axios.cjs:5063:22

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

          'Authorization',
          'Basic ' + btoa(encodeUTF8((auth.username || '') + ':' + (auth.password || '')))
        );
      }

info dynamic-execution dist/esm/axios.js:5061:22

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

          'Authorization',
          'Basic ' + btoa(encodeUTF8((auth.username || '') + ':' + (auth.password || '')))
        );
      }

info dynamic-execution dist/node/axios.cjs:6356:49

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

        headers.delete('authorization');
        headers.set('Authorization', 'Basic ' + btoa(encodeUTF8((auth.username || '') + ':' + (auth.password || ''))));
      }

info dynamic-execution lib/adapters/fetch.js:310:22

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)

          'Authorization',
          'Basic ' + btoa(encodeUTF8((auth.username || '') + ':' + (auth.password || '')))
        );
      }

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o axios-1.21.0.tgz https://registry.npmjs.org/axios/-/axios-1.21.0.tgz
printf '%s  %s\n' 3d34c8aee6495b566848b8fcfc1a70daa2921a6d9626961f6379bba29b296e8a axios-1.21.0.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf axios-1.21.0.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg