axios/axios free scan: 21 vulnerable dependencies, 0 committed secrets

axios/axios ↗ · 88fb52b · Aug 21, 2026, 11:35 PM

No issues found

Free scan · deterministic evidence only

No deterministic issues found — not a clean bill of health. 14 dimensions remain unaudited. Run Audit for the verdict.

193 of 224 files scanned (86%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.

What this means

Two scanners read 193 of 224 files: one for committed credentials, one for known vulnerabilities in your dependencies. Neither found anything. That is not a clean bill of health. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.

Read it:

Worth knowing, not blocking

24 found · 3 files · 18 packages · 3 in tests

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

test fixtureGeneric hardcoded secret3 in 3 files

README.md:437

:437 — passwo…ret' — non-production path

test/module/typings/cjs/index.ts:23

:23 — passwo…ret' — non-production path

test/module/typings/esm/index.ts:46

:46 — passwo…ret' — non-production path

dev depnpm brace-expansion3 in 1 version

1.1.11 — GHSA-3jxr-9vmj-r5cp, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — devDependency

brace-expansion: Zero-step sequence causes process hang and memory exhaustion — devDependency

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — devDependency

dev depnpm body-parser2 in 1 version

1.20.0 — GHSA-qwcr-r2fm-qrc7, GHSA-v422-hmwv-36x6

body-parser vulnerable to denial of service when url encoding is enabled — devDependency

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement — devDependency

dev depnpm @babel/core@7.19.3GHSA-4x5r-pxfx-6jf8

@babel/core: Arbitrary File Read via sourceMappingURL Comment — devDependency

dev depnpm @babel/helpers@7.19.4GHSA-968p-4wvh-cqc8

Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups — devDependency

dev depnpm @babel/plugin-transform-modules-systemjs@7.18.5GHSA-fv7c-fp4j-7gwp

@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input — devDependency

dev depnpm @babel/runtime@7.18.3GHSA-968p-4wvh-cqc8

Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups — devDependency

dev depnpm @babel/traverse@7.19.4GHSA-67hx-6x53-jw92

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code — devDependency

dev depnpm @octokit/plugin-paginate-rest@5.0.1GHSA-h5c3-5r3r-rr8q

@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking — devDependency

dev depnpm @octokit/request@6.2.2GHSA-rmvr-2pp2-xj38

@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking — devDependency

dev depnpm @octokit/request-error@3.0.2GHSA-xx4v-prfh-6cgc

@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking — devDependency

dev depnpm @tootallnate/once@1.1.2GHSA-vpq2-c234-7xj6

@tootallnate/once vulnerable to Incorrect Control Flow Scoping — devDependency

dev depnpm ajv@6.12.6GHSA-2g4f-4pwh-qvx6

ajv has ReDoS when using `$data` option — devDependency

dev depnpm babel-traverse@6.26.0GHSA-67hx-6x53-jw92

Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code — devDependency

dev depnpm bn.js@5.2.0GHSA-378v-28hj-76wf

bn.js affected by an infinite loop — devDependency

dev depnpm braces@3.0.2GHSA-grv7-fg5c-xmjg

Uncontrolled resource consumption in braces — devDependency

dev depnpm browserify-sign@4.2.1GHSA-x9w5-v3q2-3rhw

browserify-sign upper bound check issue in `dsaVerify` leads to a signature forgery attack — devDependency

dev depnpm cipher-base@1.0.4GHSA-cpq7-6gpm-g9rc

cipher-base is missing type checks, leading to hash rewind and passing on crafted data — devDependency

dev depnpm cookie@0.4.2GHSA-pxg6-pf52-xh8x

cookie accepts cookie name, path, and domain with out of bounds characters — devDependency

AI audit · axios/axios · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 193 of 224 files · axios/axios
Dependency manifests: 8 package roots found, 1 scanned — package list truncated at the vulnerability-lookup limit.

README badge

[![nittim](https://nittim.com/api/badge/axios/axios)](https://nittim.com/library/axios/axios)