🔒 Security: Pin axios to 1.8.2 — active supply chain attack on 1.14.1

[nodefather]

What

Pins axios to exact version 1.8.2 (removes ^ semver range) to prevent resolution to the compromised axios@1.14.1.

Why

There is an active supply chain attack on axios. Version 1.14.1 was published with a malicious dependency plain-crypto-js@4.2.1 — a package that did not exist before today. An attacker took over an axios maintainer account and pushed this compromised version.

The malicious package is an obfuscated dropper that:

• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages payloads into OS temp directories
• Destroys forensic evidence post-execution

⚠️ Extra Risk: No Lockfile

This repo has no package-lock.json committed. That means any npm install would resolve to the latest matching version — which right now is the compromised 1.14.1.

After merging this PR, please also:

1. Run npm install locally (the pinned version is safe)
2. Commit the generated package-lock.json

References

• https://github.com/axios/axios/issues/10590
• https://x.com/feross/status/2038807290422370479

Action

• Use npm ci (not npm install) until this is resolved upstream
• Do not upgrade axios until a clean version is confirmed
• Generate and commit a package-lock.json for this repo
• Merge this PR immediately