Node.js Module axios 0.30.4 / 1.14.1 Supply Chain Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(304406);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/01");

  script_name(english:"Node.js Module axios 0.30.4 / 1.14.1 Supply Chain Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"A module in the Node.js JavaScript run-time environment is affected by a Supply Chain vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the axios Node.js module installed on the remote host is 0.30.4 or 1.14.1. It is, therefore,
affected by a supply chain vulnerability where a supply chain attack targeting the widely used HTTP client Axios has introduced a malicious dependency 
into specific npm releases, including [email protected] and [email protected].

The latest version pulls in [email protected], a package that Socket has confirmed as malicious. The malicious package deploys a multi-stage payload, 
including a remote access trojan (RAT) capable of executing arbitrary commands, exfiltrating system data, and persisting on infected machines.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://socket.dev/blog/axios-npm-package-compromised
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8a9f889f");
  script_set_attribute(attribute:"solution", value:
"Remove axios versions 1.14.1 and 0.30.4 from the affected system and update to the latest version of axios, which is not affected by this vulnerability.");
  script_set_attribute(attribute:"agent", value:"all");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/31");

  script_set_attribute(attribute:"risk_factor", value:"Critical");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:axios:axios");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("installed_sw/Node.js", "Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

var app_info = vcf_extras::nodejs_modules::get_app_info(app:'axios');

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, 'axios');

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  { 'equal': '0.30.4', 'fixed_display' : 'Remove compromised version. Install a known good release' },
  { 'equal': '1.14.1', 'fixed_display' : 'Remove compromised version. Install a known good release' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);