fix: pin axios to v1.14.0 — supply chain attack mitigation [CRITICAL]

[apetre-ionos]

Summary

• CRITICAL: Pin axios dependency from ^1.7 to exact 1.14.0 to mitigate the supply chain attack discovered on March 30-31, 2026
• The previous caret range ^1.7 directly includes the compromised v1.14.1
• Compromised versions deploy a RAT via malicious postinstall hook (C2 at sfrclak[.]com:8000)
• Any npm install that ran between March 30-31 with this range may have pulled the malicious version

Immediate actions required

• Check CI/CD logs for any npm install runs between March 30-31, 2026
• Check network logs for connections to sfrclak[.]com:8000
• Check for IOCs: macOS /Library/Caches/com.apple.act.mond, Linux /tmp/ld.py, Windows %PROGRAMDATA%\wt.exe

Test plan

• Verify npm install completes without errors
• Run existing test suite to confirm no breaking changes
• Verify lockfile contains exactly axios@1.14.0

References

• Socket Research: Axios npm package compromised
• ISMS Advisory