Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

301–310 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#301

Post by zelphirkalt »

sspiff wrote: post #281
postalcoder wrote: post #26

PSA: npm/bun/pnpm/uv now all support setting a minimum release age for packages. I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability. bun and pnpm do not execute lifecycle scripts by default. Here's how to set global configs to set min release age to 7 days: ~/.config/uv/uv.toml exclude-newer = "7 days" ~/.npmrc min-release-age=7 # days ignore-scr…

It's wild that none of these are set by default. I know 90% of people I've worked with will never know these options exist.

If everyone or a majority of people sets these options, then I think issues will simply be discovered later. So if other people run into them first, better for us, because then the issues have a chance of being fixed once our acceptable package/version age is reached.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#302

Post by antihero »

postalcoder wrote: post #26

PSA: npm/bun/pnpm/uv now all support setting a minimum release age for packages. I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability. bun and pnpm do not execute lifecycle scripts by default. Here's how to set global configs to set min release age to 7 days: ~/.config/uv/uv.toml exclude-newer = "7 days" ~/.npmrc min-release-age=7 # days ignore-scr…

npm is claiming this doesn’t exist

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#303

Post by po1nt »

sspiff wrote: post #281
postalcoder wrote: post #26

PSA: npm/bun/pnpm/uv now all support setting a minimum release age for packages. I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability. bun and pnpm do not execute lifecycle scripts by default. Here's how to set global configs to set min release age to 7 days: ~/.config/uv/uv.toml exclude-newer = "7 days" ~/.npmrc min-release-age=7 # days ignore-scr…

It's wild that none of these are set by default. I know 90% of people I've worked with will never know these options exist.

That would likely mean same amount of people get the vulnerability, just 7 days later.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#304

Post by vasco »

friendzis wrote: post #98
postalcoder wrote: post #26

PSA: npm/bun/pnpm/uv now all support setting a minimum release age for packages. I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability. bun and pnpm do not execute lifecycle scripts by default. Here's how to set global configs to set min release age to 7 days: ~/.config/uv/uv.toml exclude-newer = "7 days" ~/.npmrc min-release-age=7 # days ignore-scr…

> (Side note, it's wild that npm, bun, and pnpm have all decided to use different time units for this configuration.) First day with javascript?

To me it sounds safer to have different big infra providers with different delays, otherwise you still hit everyone at the same time when something does inevitably go undetected.

And the chances of staying undetected are higher if nobody is installing until the delay time ellapses.

It's the same as not scheduling all cronjobs to midnight.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#305

Post by red_admiral »

There's a package manager discussion, but the bit that stands out to me is that this started with a credential compromise. At some point when a project gets big enough like axios, maybe the community could chip in to buy the authors a couple of YubiHSM or similar. I wish that _important keys live in hardware_ becomes more standard given the stakes.

Dealing with dependencies is another question; if it's stupid stuff like leftpad then it should be either vendored in or promoted to be a language feature anyway (as it has been).

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#306

Post by hu3 »

charcircuit wrote: post #247
hu3 wrote: post #207

Earlier quoted context omitted.

What do you mean? Linux has the most powerful native process isolation arsenal at the user disposal. And some distros use even more isolation mechanisms on top of the ones provided by the kernel like snap and flatpak. And then you can recreate the entire thing like a spellbook with nix. Docker works natively in it. Do I need to say more? Linux is a decade ahead here with regards for security options available to the…

Yet npm isn't using them allowing this RAT to work. It is not secure by default. It requires every app to manually opt in to being secure. This opt in approach to security puts desktop Linux decades behind in regards to security. Not ahead.

Linux is not making anything less secure than other OSs.

In fact it even gives the user more security tools.

So I fail to reason on you singling out Linux here.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#307

Post by _pdp_ »

I am not saying this is the reason for this compromise but the sudden explosion of coding assistant like claude code, and tools like openclaw is teaching entire crop of developers (and users) that it is ok to have sensitive credentials .env files.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#308

Post by consp »

goodpoint wrote: post #194
rectang wrote: post #70

Earlier quoted context omitted.

Hosting curated dependencies is a commercially valuable service. Eventually an economy arises where people pay vendors to vet packages.

It's what linux distributions do.

Queue appimage or other packed binary and there go your finetuned packages.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#310

Post by charcircuit »

hu3 wrote: post #306
charcircuit wrote: post #247

Earlier quoted context omitted.

Yet npm isn't using them allowing this RAT to work. It is not secure by default. It requires every app to manually opt in to being secure. This opt in approach to security puts desktop Linux decades behind in regards to security. Not ahead.

Linux is not making anything less secure than other OSs. In fact it even gives the user more security tools. So I fail to reason on you singling out Linux here.

Take for example iOS and Android. All apps are sandboxed by default. You can't make a program that just steals all of your credentials like you can on desktop Linux. Having security tools means nothing if they aren't being used.
Post reply on HN