Pin axios to 1.14.0 to avoid compromised version

[mustafa-poly]

Summary

• Pins axios from ^1.0.0 to 1.14.0 to prevent installing the compromised 1.14.1 version
• axios 1.14.1 was published March 30, 2026 via a hijacked maintainer account and contains a malicious plain-crypto-js dependency that deploys a cross-platform RAT
• See: https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

Test plan

• Verify pnpm install resolves axios to exactly 1.14.0
• Confirm no plain-crypto-js in node_modules
• Run existing tests to ensure no regressions

🤖 Generated with Claude Code

---

Note

Low Risk
Low risk dependency change that only affects the resolved axios (and its lockfile transitive proxy-from-env) versions; runtime behavior should be effectively unchanged aside from any patch-level axios differences.

Overview
Prevents installs from floating to newer axios releases by changing the dependency range from ^1.0.0 to an exact 1.14.0.

Updates pnpm-lock.yaml to lock axios@1.14.0 (including the related transitive bump to proxy-from-env@2.1.0) and aligns the @polymarket/builder-signing-sdk dependency tree to the same axios version.

^{Written by Cursor Bugbot for commit 918fd5b. This will update automatically on new commits. Configure here.}