Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

721–730 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#721

Post by ytpete »

mrits wrote: post #695
rhdunn wrote: post #674

Earlier quoted context omitted.

There are several issues with "Batteries Included" ecosystems (like Python, C#/.NET, and Java): 1. They are not going to include everything. This includes things like new file formats. 2. They are going to be out of date whenever a standard changes (HTML, etc.), application changes (e.g. SQLite/PostgreSQL/etc. for SQL/ORM bindings), or API changes (DirectX, Vulcan, etc.). 3. Things like data structures, graphics APIs…

Python, .NET, and Java are not examples of batteries included. Django and Spring

And in fact wasn't a popular Python library just compromised very recently? See https://news.ycombinator.com/item?id=47501426.

So Python's clearly not "batteries included" enough to avoid this kind of risk.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#723

Post by rhdunn »

zymhan wrote: post #692
rhdunn wrote: post #674

Earlier quoted context omitted.

There are several issues with "Batteries Included" ecosystems (like Python, C#/.NET, and Java): 1. They are not going to include everything. This includes things like new file formats. 2. They are going to be out of date whenever a standard changes (HTML, etc.), application changes (e.g. SQLite/PostgreSQL/etc. for SQL/ORM bindings), or API changes (DirectX, Vulcan, etc.). 3. Things like data structures, graphics APIs…

> They are going to be out of date whenever a standard changes (HTML, etc.) You might want to elaborate on the "etc.", since HTML updates are glacial.

The HTML "Living Standard" is constantly updated [1-6].

The PNG spec [7] has been updated several times in 1996, 1998, 1999, and 2025.

The XPath spec [8] has multiple versions: 1.0 (1999), 2.0 (2007), 3.0 (2014), and 3.1 (2017), with 4.0 in development.

The RDF spec [9] has multiple versions: 1.0 (2004), and 1.1 (2014). Plus the related specs and their associated versions.

The schema.org metadata standard [10] is under active development and is currently on version 30.

[1] https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... (New)

[2] https://web.dev/baseline/2025 -- popover API, plain text content editable, etc.

[3] https://web.dev/baseline/2024 -- exclusive accordions, declarative shadow root DOM

[4] https://web.dev/baseline/2023 -- inert attribute, lazy loading iframes

[5] https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... (Baseline 2023)

[6] https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/... (2020)

[7] https://en.wikipedia.org/wiki/PNG

[8] https://en.wikipedia.org/wiki/XPath

[9] https://en.wikipedia.org/wiki/Resource_Description_Framework

[10] https://schema.org/

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#725

Post by rhdunn »

ytpete wrote: post #721
mrits wrote: post #695

Earlier quoted context omitted.

Python, .NET, and Java are not examples of batteries included. Django and Spring

And in fact wasn't a popular Python library just compromised very recently? See https://news.ycombinator.com/item?id=47501426 . So Python's clearly not "batteries included" enough to avoid this kind of risk.

That's my point. You can have a large standard library like those languages I mentioned, but that isn't going to include everything nor cover every use case, so you'll have external libraries (via PyPi for Python, NuGet for .NET, and Maven for Java/JVM).

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#726

Post by strogonoff »

habinero wrote: post #660
strogonoff wrote: post #395

Earlier quoted context omitted.

> you'd need to install the depdencency the first time to get it in VC, but then suddenly down when doing a deploy. Which dependency? It sounds like you are assuming some specific scenario, whereas the fix can take many forms. In immediate term, the quickest step could be to simply disable some feature. A later step may be vendoring in a safe implementation. The registry doesn’t need to be actually down for you , eit…

This is why Artifactory and similar exist and they do this better. You ~never want to vendor libraries.

Are you saying it replaces my package manager, or that I should add another tool to my stack, vet yet another vulnerable dependency for critical use, to do something my package manager already does just as well?

> You ~never want to vendor libraries.

I just explained why you should, and you are yet to provide a counter-argument.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#727

Post by pyrolistical »

benoau wrote: post #645
h4ch1 wrote: post #13

I can't even imagine the scale of the impact with Axios being compromised, nearly every other project uses it for some reason instead of fetch (I never understood why). Also from the report: > Neither malicious version contains a single line of malicious code inside axios itself. Instead, both inject a fake dependency, plain-crypto-js@4.2.1, a package that is never imported anywhere in the axios source, whose only pu…

> (I never understood why). I spent two years trying to get it out of a project that began long after Axios had become redundant but it's very hard to go back and challenge decisions like this because every business priority is aligned against this kind of work. I expect libraries built on top of fetch will be the next to be compromised, because why would you use fetch without an arbitrary layer of syntactic sugar...

There was never the business value. But now remember this axios case and use it as ammo for the next issue. Just don’t abuse it

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#728

Post by simonkagedal »

moebrowne wrote: post #618
xenophonf wrote: post #391

Earlier quoted context omitted.

Where in the pnpm documentation does it say that it ignores scripts by default? From https://pnpm.io/cli/install#--ignore-scripts : > Default: *false*

Weird. The config also appears to default to `false` https://pnpm.io/settings#ignorescripts

This page describes the behavior, "disables the automatic execution of postinstall scripts in dependencies":

https://pnpm.io/supply-chain-security

While this explicitly calls out "postinstall", I'm pretty sure it affects other such lifecycle scripts like preinstall in dependencies.

The --ignore-scripts option will ignore lifecycle scripts in the project itself, not just dependencies. And it will ignore scripts that you have previously allowed (using the "allowBuilds" feature).

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#730

Post by pyrolistical »

vincnetas wrote: post #161
nananana9 wrote: post #114

Package managers are a failed experiment. We have libraries like SQLite, which is a single .c file that you drag into your project and it immediately does a ton of incredibly useful, non-trivial work for you, while barely increasing your executable's size. The issue is not dependencies themselves, it's transitive ones. Nobody installs left-pad or is-even-number directly, and "libraries" like these are the vast majori…

no no, please we don't want to get back to dragging files to your project to make them work.

You don’t need to. Llm will do it for you and include the security bug
Post reply on HN