The source repo doesn't have a package.json, so I extracted the version directly from the binary (~/.local/share/claude/versions/2.1.87)

Axios sets a VERSION constant that it uses in user-agent headers, boundaries and errors. I scanned the binary for all references like axios, isAxiosError and AxiosError - the code references the same variable namespace (X1H, Tj, eq), suggesting a single bundled copy. In the minified bundle, that VERSION constant was stored in a variable called X1H. Searching the binary for all references to X1H confirms it's only used in axios contexts:

  var X1H="1.13.6"
  E.set("User-Agent","axios/"+X1H, ...)
  {tag:`axios-${X1H}-boundary`, ...}
  "[Axios v"+X1H+"] Transitional option ..."
  Tj.VERSION=X1H; Tj.AxiosError=eq; Tj.CancelToken=...

The bundled version is 1.13.6 - well before the compromised 1.14.1. I also checked that "1.14.1", "plain-crypto", and "sfrclak.com" are all absent from the binary.