A specialized security utility designed to detect and remediate malicious axios supply chain injections and backdoors in frontend projects.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install axios-supply-chain-attack-check
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install axios-supply-chain-attack-check using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Axios Supply Chain Attack Checker?
The Axios Supply Chain Attack Checker is a critical security tool developed to address the high-risk supply chain vulnerability involving axios versions 1.14.1 and 0.30.4. These specific versions were identified as containing malicious injections capable of compromising development and build environments. By leveraging this tool within the Openclaw Skills ecosystem, developers can ensure their dependency tree is free from these threats and the associated plain-crypto-js@4.2.1 backdoor.
This skill provides an automated baseline for emergency response, allowing teams to scan their node_modules and lockfiles for known-bad signatures. It is an essential asset for maintainers who need to verify project integrity after reports of ecosystem-wide dependency poisoning.
Axios Supply Chain Attack Checker Use Cases
- Detecting malicious axios versions 1.14.1 or 0.30.4 in existing frontend repositories.
- Identifying the presence of the plain-crypto-js@4.2.1 backdoor dependency.
- Investigating suspicious outbound network traffic originating from build servers or development environments.
- Performing routine security audits on newly cloned repositories before running npm install.
How Axios Supply Chain Attack Checker Works
- The user triggers the Openclaw Skills script within the root directory of a frontend project.
- The system locates the internal security audit script (
check-axios-risk.sh). - The script parses the project dependency tree, checking
package.json,package-lock.json, andyarn.lockfor targeted risk versions. - It specifically flags any reference to the compromised axios releases or the plain-crypto-js malicious package.
- A summary report is generated, indicating whether the environment is clean or requires immediate dependency resolution.
Axios Supply Chain Attack Checker Setup
To utilize this skill, ensure you have the script available in your local repository path. You can execute the check using the following command:
bash ./scripts/check-axios-risk.sh
Axios Supply Chain Attack Checker Data Schema & Taxonomy
The skill focuses on auditing local configuration files and reporting status. It interacts with the following data points:
| Data Source | Purpose |
|---|---|
| package.json | Scans declared dependencies and devDependencies |
| lockfiles | Inspects resolved versions of sub-dependencies to find hidden injections |
| node_modules | (Optional) Verification of physical files on disk for known signatures |
| Output Log | Provides a binary 'Clean' or 'At Risk' status for the audit |
Axios Supply Chain Attack Checker Advanced Features
- Multi-package support: Can be integrated into monorepo workflows to scan multiple sub-packages simultaneously.
- CI/CD Hook: Easily integrated into GitHub Actions or GitLab CI to block builds containing poisoned dependencies.
- Automated Remediation: Can be extended to force-update or resolution-override the compromised packages via Openclaw Skills automation.
SKILL.md
Loading
Related Openclaw Skills
Sales Cold Outreach Message Generator
A professional AI-driven generator designed to create personalized, multi-channel cold outreach messages that significantly increase recipient engagement.
pytest-test-master
A comprehensive expert guide for mastering pytest architectures, advanced fixture management, and enterprise-grade testing strategies.
Live Streaming Sales Script Generator
A specialized AI tool designed to generate high-converting live streaming scripts for platforms like Douyin, Kuaishou, and Taobao.
English Visual Vocabulary
An intelligent English learning tool that leverages visual memory and scientific review cycles to accelerate vocabulary acquisition.
Private Community Daily Report Generator
An automated content engine designed to generate high-value morning and evening reports for private WeChat and Enterprise WeChat communities.
API Test Reporter
Transform API documentation into automated test suites with visual HTML reporting and database-driven validation.
Featured*
