Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

101–110 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#101

Post by tick_tock_tick »

brigandish wrote: post #91
vsgherzi wrote: post #63

Not to beat a dead horse but I see this again and again with dependencies. Each time I get more worried that the same will happen with rust. I understand the fat std library approach won’t work but I really still want a good solution where I can trust packages to be safe and high quality.

An alternative: - copy the dependencies' tests into your own tests - copy the code in to your codebase as a library using the same review process you would for code from your own team - treat updates to the library in the same way you would for updates to your own code Apparently, this extra work will now not be a problem, because we have AI making us 10x more efficient. To be honest, even without AI, we should've be…

I don't know where you've worked but a hostile and intelligent actor or internal red team would succeed under each of those cases at every job I've worked at.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#102

Post by nathanmills »

peddling-brink wrote: post #95
nathanmills wrote: post #67

Earlier quoted context omitted.

No, I will not stop trying to create a more standardized and secure software ecosystem.

The comment you replied to is a quote from the movie Mean Girls. https://knowyourmeme.com/memes/stop-trying-to-make-fetch-hap...

Thats a coincidence

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#104

Post by friendzis »

wps wrote: post #50

Genuinely how are you supposed to make sure that none of the software you have on your system pulls this in? It’s things like this that make me want to swap to Qubes permanently, simply as to not have my password manager in the same context as compiling software ever.

[flagged]

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#105

Post by slopinthebag »

waterTanuki wrote: post #31
slopinthebag wrote: post #5

It's reasons like this why I refuse to download Node or use anything NPM. Thankfully other languages are better anyways.

Because no other language has ever had supply chain attacks ever, in history. Nope. https://blog.rust-lang.org/2022/05/10/malicious-crate-rustde... https://en.wikipedia.org/wiki/Log4Shell https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-an... https://about.gitlab.com/blog/gitlab-catches-mongodb-go-modu... https://www.reversinglabs.com/blog/packagist-php-repo-supply...

Come on dude. The issue is the frequency and magnitude of these attacks. Log4Shell was also not a supply chain attack.

I looked at the Rust one for example, which is literally just a malicious crate someone uploaded with a similar name as a popular one:

> The crate had less than 500 downloads since its first release on 2022-03-25, and no crates on the crates.io registry depended on it.

Compared to Axios, which gets 83 million downloads and was directly compromised.

What an extremely disingenuous argument lol

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#106

Post by slopinthebag »

hrmtst93837 wrote: post #103
slopinthebag wrote: post #5

It's reasons like this why I refuse to download Node or use anything NPM. Thankfully other languages are better anyways.

[flagged]

Cargo is a great package manager and hasn't suffered from the same problems. I'll take it.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#107

Post by notpushkin »

friendzis wrote: post #98
postalcoder wrote: post #26

PSA: npm/bun/pnpm/uv now all support setting a minimum release age for packages. I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability. bun and pnpm do not execute lifecycle scripts by default. Here's how to set global configs to set min release age to 7 days: ~/.config/uv/uv.toml exclude-newer = "7 days" ~/.npmrc min-release-age=7 # days ignore-scr…

> (Side note, it's wild that npm, bun, and pnpm have all decided to use different time units for this configuration.) First day with javascript?

You mean first 86,400 seconds?

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#108

Post by weird-eye-issue »

superjan wrote: post #88
postalcoder wrote: post #26

PSA: npm/bun/pnpm/uv now all support setting a minimum release age for packages. I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability. bun and pnpm do not execute lifecycle scripts by default. Here's how to set global configs to set min release age to 7 days: ~/.config/uv/uv.toml exclude-newer = "7 days" ~/.npmrc min-release-age=7 # days ignore-scr…

About the use of different units: next time you choose a property name in a config file, include the unit in the name. So not “timeout” but “timeoutMinutes”.

timeoutMs is shorter ;)

You guys can't appreciate a bad joke

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#109

Post by flanbiscuit »

postalcoder wrote: post #26

PSA: npm/bun/pnpm/uv now all support setting a minimum release age for packages. I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability. bun and pnpm do not execute lifecycle scripts by default. Here's how to set global configs to set min release age to 7 days: ~/.config/uv/uv.toml exclude-newer = "7 days" ~/.npmrc min-release-age=7 # days ignore-scr…

Pnpm did this first but I’m glad to see all the others follow suit

For anyone wondering, you need to be on npm >= 11.10.0 in order to use it. It just became available Feb 11 2026

https://github.com/npm/cli/releases/tag/v11.10.0

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#110

Post by pjmlp »

The amount of people still using this instead of fetch. Nonetheless when wasn't axios, it would be something else.

This is why corporations doing it right don't allow installing the Internet into dev machines.

Yet everyone gets to throw their joke about PC virus, while having learnt nothing from it.

Post reply on HN