Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

31–40 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#31

Post by waterTanuki »

slopinthebag wrote: post #5

It's reasons like this why I refuse to download Node or use anything NPM. Thankfully other languages are better anyways.

Because no other language has ever had supply chain attacks ever, in history. Nope.

https://blog.rust-lang.org/2022/05/10/malicious-crate-rustde...

https://en.wikipedia.org/wiki/Log4Shell

https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-an...

https://about.gitlab.com/blog/gitlab-catches-mongodb-go-modu...

https://www.reversinglabs.com/blog/packagist-php-repo-supply...

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#33

Post by jmward01 »

This may not be popular, but is there a place for required human actions or just timed actions to slow down things like this? For instance, maybe a GH action to deploy requires a final human click and to change that to cli has a 3 day cooling period with mandatory security emails sent out. Similarly, you switch to read only for 6 hrs after an email change. There are holes in these ideas but the basic concept is to treat security more like physical security, your goal isn't always to 100% block but instead to slow an attacker for xxx minutes to give the rest of the team time to figure out what is going on.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#34

Post by Tazerenix »

rybosome wrote: post #17
jadar wrote: post #8

How much do you want to bet me that the credential was stolen during the previous LiteLLM incident? At what point are we going to have to stop using these package managers because it's not secure? I've got to admit, it's got me nervous to use Python or Node.js these days, but it's really a universal problem.

> it’s got me nervous to use Python or Node.js these days My feelings precisely. Min package age (supported in uv and all JS package managers) is nice but I still feel extremely hesitant to upgrade my deps or start a new project at the moment. I don’t think this is going to stabilize any time soon, so figuring out how to handle potentially compromised deps is something we will all need to think about.

NPM only gained minimum package age in February of this year, and still doesn't support package exclusions for internal packages.

https://github.com/npm/cli/pull/8965

https://github.com/npm/cli/issues/8994

Its good that that they finally got there but....

I would be avoiding npm itself on principle in the JS ecosystem. Use a package manager that has a history of actually caring about these issues in a timely manner.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#35

Post by bluepeter »

Min release age sucks, but we’ve been here before. Email attachments used to just run wild too, then everyone added quarantine delays and file blocking and other frictions... and it eventually kinda/sorta worked. This does feel worse, though, with fewer chokepoints and execution as a natural part of the expectation.

Edit: bottom line is installs are gonna get SOOO much more complicated. You can already see the solution surface... Cooling periods, maintainer profiling, sandbox detonation, lockfile diffing, weird publish path checks. All adds up to one giant PITA for fast easy dev.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#37

Post by esseph »

btown wrote: post #19
tonymet wrote: post #11

Earlier quoted context omitted.

Slow Russian roulette is still a losing strategy

It’s only a losing strategy if you assume everyone universally adopts the slow strategy, and no research teams spot it in the interim. For things with large splash radius, that’s unrealistic, so defenders have an information advantage. Makes actual security patches tougher to roll out though - you need to be vigilant to bypass the slowdown when you’re actually fixing a critical flaw. But nobody said this would be eas…

> Makes actual security patches tougher to roll out though

Yeah. 7 days in 2026 is a LONG TIME for security patches, especially for anything public facing.

Stuck between a rock (dependency compromise) and a hard place (legitimate security vulnerabilities).

Doesn't seem like a viable long-term solution.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#38

Post by nathanmills »

meekins wrote: post #23
seer wrote: post #18

Earlier quoted context omitted.

Also it has interceptors, which allow you to build easily reusable pieces of code - loggers, oauth, retriers, execution time trackers etc. These are so much better than the interface fetch offers you, unfortunately.

It also supports proxies which is important to some corporate back-end scenarios

fetch supports proxies

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#40

Post by esseph »

tonymet wrote: post #14

Has anyone tested general purpose malware detection on supply chains ? Like clamscan . I tried to test the LiteLLM hack but the affected packages had been pulled. Windows Defender AV has an inference based detector that may work when signatures have not yet been published

> Has anyone tested general purpose malware detection on supply chains ? Like clamscan

You could use Trivy! /s

Post reply on HN