convenient

Context

• https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
• axios/axios#10604

On March 31, 2026, StepSecurity identified two malicious versions of the widely used axios HTTP client library published to npm: axios@1.14.1 and axios@0.30.4

The malicious versions inject a new dependency, plain-crypto-js@4.2.1, which is never imported anywhere in the axios source code. Its sole purpose is to execute a postinstall script that acts as a cross platform remote access trojan (RAT) dropper, targeting macOS, Windows, and Linux. The dropper contacts a live command and control server and delivers platform specific second stage payloads. After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection.

If you have installed axios@1.14.1 or axios@0.30.4, assume your system is compromised.

convenient

vendor/magento/framework/Logger/Monolog.php

    public function addRecord($level, $message, array $context = [])
    {
        $context[uniqid('trace')] = (new \Exception())->getTraceAsString();

convenient

You can apply custom patch files as a post composer script

https://support.magento.com/hc/en-us/articles/360005484154-Create-a-patch-for-a-Magento-2-Composer-installation-from-a-GitHub-commit

Use the attached patch files to correct this issue.

mkdir -p patches/composer/magento/module-staging/
nano patches/composer/magento/module-staging/fix-staging-test.patch

convenient

<?php
error_reporting( error_reporting() & ~E_NOTICE & ~E_WARNING);

/**
 * @param SimpleXMLElement|bool $element
 * @return string
 */
function loadedOkay($element)
{
    if ($element === true) {

convenient

cut -f 5- -d ':' /var/www/vhosts/project.com/var/log/system.log | sort -n | uniq -c | sort -nr | head -20


Get all 404 requests from log
`lecli query --loggroup bes_web --leql 'where(status=404 AND request!=/(.*?)favicon.ico/)' -r 'last 1 hour'`
`grep -Eo ".{0,255}query" 404.log | sed -e 's/\", "query//' | cut -d ":" -f9 | sed 's/^.//'`


cat reqs.log | sed -e 's/.*userAgent...//' -e 's/.referer.*..//'

convenient

select IF(count(schedule_id) = 0, 'stuck', 'okay') as crons from cron_schedule where finished_at is not null and finished_at >= DATE_SUB(NOW(), INTERVAL 2 HOUR);

convenient

cat /var/log/httpd/access.SSL.log | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -20

convenient

phpbrew install 5.3.26 +default +dbs +apxs2
phpbrew ext install iconv
phpbrew ext install gd
phpbrew ext install xdebug 2.2.3

#nano /home/luker/.phpbrew/php/php-5.3.26/var/db/xdebug.ini
xdebug.remote_host = 127.0.0.1
xdebug.remote_enable = 1
xdebug.remote_port = 9000
xdebug.remote_handler = dbgp

convenient

select count(*) from catalog_product_index_price_cl where version_id > (select version_id from enterprise_mview_metadata where changelog_name='catalog_product_index_price_cl');

convenient

cd ~/path/to/folder/ && find . -name '*.php' | sort -d | xargs md5sum

#files with spaces
cd . && find . -name '*.mp3' | xargs -d '\n' md5sum | sort -k 3