# axios@1.13.1 security report (npm)

- Verdict: **No issues** (risk level: safe)
- Scanned: 2026-05-15T12:29:04.000Z
- Files reviewed: 64
- Findings: no findings
- Report: https://security.togoder.click/npm/axios@1.13.1
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the npm package axios@1.13.1 on May 15, 2026. An AI review of 64 source files produced no findings. No malicious behavior, install-time payloads, credential theft or exfiltration were identified.

## Findings

No findings.

## Files reviewed

- `Axios.js` (safe): No malicious patterns detected
- `AxiosError.js` (safe): No malicious patterns detected
- `AxiosHeaders.js` (safe): No malicious patterns detected
- `AxiosTransformStream.js` (safe): No malicious patterns detected
- `AxiosURLSearchParams.js` (safe): The code implements standard URL encoding and parameter handling logic typical of utility libraries and contains no malicious patterns.
- `Blob.js` (safe): No malicious patterns detected
- `CancelToken.js` (safe): No malicious patterns detected
- `CanceledError.js` (safe): No malicious patterns detected
- `FormData.js` (safe): No malicious patterns detected
- `FormData.js` (safe): No malicious patterns detected
- `FormData.js` (safe): No malicious patterns detected
- `HttpStatusCode.js` (safe): No malicious patterns detected
- `InterceptorManager.js` (safe): No malicious patterns detected
- `URLSearchParams.js` (safe): No malicious patterns detected
- `URLSearchParams.js` (safe): The code simply re-exports a standard Node.js API (url.URLSearchParams) without any suspicious behavior or malicious patterns.
- `ZlibHeaderTransformStream.js` (safe): No malicious patterns detected
- `adapters.js` (safe): No malicious patterns detected
- `axios.cjs` (safe): No malicious patterns detected
- `axios.js` (safe): No malicious patterns detected
- `bind.js` (safe): No malicious patterns detected
- `buildFullPath.js` (safe): No malicious patterns detected
- `buildURL.js` (safe): No malicious patterns detected
- `callbackify.js` (safe): No malicious patterns detected
- `combineURLs.js` (safe): No malicious patterns detected
- `composeSignals.js` (safe): No malicious patterns detected
- `cookies.js` (safe): No malicious patterns detected
- `data.js` (safe): No malicious patterns detected
- `deprecatedMethod.js` (safe): No malicious patterns detected
- `dispatchRequest.js` (safe): No malicious patterns detected
- `estimateDataURLDecodedBytes.js` (safe): No malicious patterns detected
- `fetch.js` (safe): No malicious patterns detected
- `formDataToJSON.js` (safe): No malicious patterns detected
- `formDataToStream.js` (safe): No malicious patterns detected
- `fromDataURI.js` (safe): Standard data URI parsing utility with no malicious patterns detected.
- `http.js` (safe): No malicious patterns detected
- `index.js` (safe): No malicious patterns detected
- `index.js` (safe): No malicious patterns detected
- `index.js` (safe): No malicious patterns detected
- `index.js` (safe): No malicious patterns detected
- `index.js` (safe): No malicious patterns detected
- `isAbsoluteURL.js` (safe): No malicious patterns detected
- `isAxiosError.js` (safe): No malicious patterns detected
- `isCancel.js` (safe): No malicious patterns detected
- `isURLSameOrigin.js` (safe): No malicious patterns detected
- `mergeConfig.js` (safe): No malicious patterns detected
- `null.js` (safe): No malicious patterns detected
- `parseHeaders.js` (safe): The code implements a standard HTTP header parser with no malicious patterns detected.
- `parseProtocol.js` (safe): No malicious patterns detected
- `progressEventReducer.js` (safe): No malicious patterns detected
- `readBlob.js` (safe): No malicious patterns detected; the code is a standard utility for reading Blob objects using native Web APIs and Symbol.asyncIterator.
- `resolveConfig.js` (safe): No malicious patterns detected
- `settle.js` (safe): No malicious patterns detected
- `speedometer.js` (safe): No malicious patterns detected
- `spread.js` (safe): No malicious patterns detected
- `throttle.js` (safe): The code implements a standard throttle utility function with no malicious patterns detected.
- `toFormData.js` (safe): No malicious patterns detected
- `toURLEncodedForm.js` (safe): No malicious patterns detected
- `trackStream.js` (safe): No malicious patterns detected
- `transformData.js` (safe): No malicious patterns detected
- `transitional.js` (safe): No malicious patterns detected
- `utils.js` (safe): No malicious patterns detected; this is standard runtime environment detection code commonly found in libraries like axios.
- `utils.js` (safe): No malicious patterns detected
- `validator.js` (safe): No malicious patterns detected
- `xhr.js` (safe): No malicious patterns detected; this is a standard XMLHttpRequest adapter implementation typical of the Axios HTTP client library.

## Version ranges

None of the 3 scanned versions of axios are flagged high or critical. The latest scanned version, 1.20.0, is clean. Only versions we have scanned are listed; unscanned versions between them are not covered.

- 1.20.0 (`1.20.0`): clean
- 1.18.1 (`1.18.1`): not scanned
- 1.13.1 – 1.13.2 (`>=1.13.1 <=1.13.2`): clean
- 1.12.2 (`1.12.2`): not scanned

## Scanned versions

- [1.20.0](https://security.togoder.click/npm/axios@1.20.0): safe, 2026-10-06T14:13:47.000Z
- [1.13.2](https://security.togoder.click/npm/axios@1.13.2): safe, 2026-10-04T16:55:49.000Z
- [1.13.1](https://security.togoder.click/npm/axios@1.13.1): safe, 2026-05-15T12:29:04.000Z

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology