Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

501–510 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#501

Post by Xirdus »

dspillett wrote: post #490
x0x0 wrote: post #158

Earlier quoted context omitted.

You have to admire the person who designed the flexibility to have 87239 seconds not be old enough, but 87240 to be fine.

Probably went with the simplest implementation, if starting from the current “seconds since epoch” value. Let the user do any calculations needed to translate three days into that measurement. It also efficiently annoys the most people at once: those what want hours will complain if they set it to days, thought that want days will complain if hours are used. By using minutes or seconds you can wind up both segments w…

I'm old enough to remember computers being pitched as devices that can do tedious math for us. Now we have to do tedious math for them apparently.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#503

Post by tonymet »

neko_ranger wrote: post #20
tonymet wrote: post #11

Earlier quoted context omitted.

Slow Russian roulette is still a losing strategy

but wouldn't it work in this case? sure if a package was compromised for months/years it wouldn't save you but tell dependabot to delay a week, you'd sleep easy from this nonesense

slowly walking through a minefield isn’t any safer than running.

So unless you’re saying the extra time will be spent inspecting every package, whenever you do update, you will be getting an insecure package.

You’re not safe by dodging axios. There are currently thousands of breached packages ready to install that aren’t notable.

“I’ll run npm install after checking twitter” won’t help

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#504

Post by mike_hearn »

narrator wrote: post #268
mike_hearn wrote: post #227

Earlier quoted context omitted.

Their analysis was triggered by open source projects upgrading en-masse and revealing a new anomalous endpoint, so, it does require some pioneers to take the arrows. They didn't spot the problem entirely via static analysis, although with hindsight they could have done (missing GitHub attestation).

A security company could set up a honeypot machine that installs new releases of everything automatically and have a separate machine scan its network traffic for suspicious outbound connections.

The problem is what counts as suspicious. StepSecurity are quite clear in their post that they decide what counts as anomalous by comparing lots of open source runs against prior data, so they can't figure it out on their own.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#505

Post by _pdp_ »

ptx wrote: post #337
_pdp_ wrote: post #307

I am not saying this is the reason for this compromise but the sudden explosion of coding assistant like claude code, and tools like openclaw is teaching entire crop of developers (and users) that it is ok to have sensitive credentials .env files.

Where would you suggest putting the sensitive credentials?

Not in .env files next to your code that is exposed to supply chain risks.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#507

Post by senordevnyc »

invaliduser wrote: post #414
troad wrote: post #347

Earlier quoted context omitted.

Ah, so you've traded the possibility of bad dependencies for certainty.

How can you come to that conclusion, given the specific examples I have given, which are tedious to write, but easy to proof-read and test?

Because AI threatens the identity of many programmers.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#508

Post by jmull »

pier25 wrote: post #442
afavour wrote: post #370

Earlier quoted context omitted.

Irony is that Node has no need for Axios, native fetch support has been there for years, so in terms of network requests it is batteries included.

People use axios or ky because with fetch you inevitably end up writing a small wrapper on top of it anyway.

In my experience people feel the need to wrap axios too.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#509

Post by jon-wood »

woodruffw wrote: post #500
wongarsu wrote: post #319

Earlier quoted context omitted.

Seconds are also unambiguous. Depending on your chosen definition, "X days" may or may not be influenced by leap seconds and DST changes. I doubt anyone cares about an hour more or less in this context. But if you want multiple implementations to agree talking about seconds on a monotonic timer is a lot simpler

Could you explain what you mean re: ambiguity? I understand why “calendar units” like months are ambiguous, but minutes, hours, days, and weeks all have fixed durations (which is why APIs like Python’s `timedelta` allows them).

In the UK last Sunday was 23 hours long because we switched to BST, and occasionally leap seconds will result in a minute being something other 60 seconds.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#510

Post by nedt »

beart wrote: post #16
h4ch1 wrote: post #13

I can't even imagine the scale of the impact with Axios being compromised, nearly every other project uses it for some reason instead of fetch (I never understood why). Also from the report: > Neither malicious version contains a single line of malicious code inside axios itself. Instead, both inject a fake dependency, plain-crypto-js@4.2.1, a package that is never imported anywhere in the axios source, whose only pu…

> nearly every other project uses it for some reason instead of fetch (I never understood why). Fetch wasn't added to Node.js as a core package until version 18, and wasn't considered stable until version 21. Axios has been around much longer and was made part of popular frameworks and tutorials, which helps continue to propagate it's usage.

Before that we had node-fetch. If you already use a dependency why not one that's pretty much what will come natively to every JS runtime soon.
Post reply on HN