3 ms·

This is good info, thanks. Can I ask how you detected that version of axios? I checked the source (from another comment) and the package.json dependencies are e

• ankaz 6mo ago
  The source repo doesn't have a package.json, so I extracted the version directly from the binary (~/.local/share/claude/versions/2.1.87) Axios sets a VERSION constant that it uses in user-agent headers, boundaries and errors. I scanned the binary for all references like axios, isAxiosError and AxiosError - the code references the same variable namespace (X1H, Tj, eq), suggesting a single bundled copy. In the minified bundle, that VERSION constant was stored in a variable called X1H. Searching the binary for all references to X1H confirms it's only used in axios contexts: var X1H="1.13.6" E.set("User-Agent","axios/"+X1H, ...) {tag:`axios-${X1H}-boundary`, ...} "[Axios v"+X1H+"] Transitional option ..." Tj.VERSION=X1H; Tj.AxiosError=eq; Tj.CancelToken=... The bundled version is 1.13.6 - well before the compromised 1.14.1. I also checked that "1.14.1", "plain-crypto", and "sfrclak.com" are all absent from the binary.