Axios compromised on NPM – Malicious versions drop remote access trojan
1–10 of 894 posts
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#2Supply chain woes continue
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#3> Both versions were published using the compromised npm credentials of a lead axios maintainer, bypassing the project's normal GitHub Actions CI/CD pipeline.
Doesn’t npm mandate 2FA as of some time last year? How was that bypassed?
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#4Incident tracking:
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#5It's reasons like this why I refuse to download Node or use anything NPM. Thankfully other languages are better anyways.
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#6Supply chain woes continue
One more reason to use Fetch
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#7Should increase the delay to dependency updates.
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#8How much do you want to bet me that the credential was stolen during the previous LiteLLM incident? At what point are we going to have to stop using these package managers because it's not secure? I've got to admit, it's got me nervous to use Python or Node.js these days, but it's really a universal problem.
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#9Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#10> Both versions were published using the compromised npm credentials of a lead axios maintainer, bypassing the project's normal GitHub Actions CI/CD pipeline. Doesn’t npm mandate 2FA as of some time last year? How was that bypassed?
Apparently it's possible to create access tokens that bypass 2FA. Might've been this.