npm security team has removed the offending package: https://github.com/axios/axios/issues/10604#issuecomment-415...

new installs should be safe now