Security Vulnerability(Usage of unclaimed npm package leads to RCE)

[xaiervishu0410]

In this file there is a dependency named as "axiom-base" with 1.0.0 version.

I searched for this package and there was no package in npmjs.com

So I published a package with same name "axiom-base" with higher version "3.0.0".

We can see at: https://www.npmjs.com/package/axiom-base

This vulnerability is famous "Dependency Confusion Attack"

Reference: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

Attack scenario:

If these package had been claimed by an attacker, this would have led to arbitrary code execution on the affected server.