Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

171–180 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#171

Post by swiftcoder »

voidfunc wrote: post #135
nananana9 wrote: post #114

Package managers are a failed experiment. We have libraries like SQLite, which is a single .c file that you drag into your project and it immediately does a ton of incredibly useful, non-trivial work for you, while barely increasing your executable's size. The issue is not dependencies themselves, it's transitive ones. Nobody installs left-pad or is-even-number directly, and "libraries" like these are the vast majori…

I'd really like to see package managers organized around rings where a very small core of incredibly important stuff is kept in ring 0, ring 1 gets a slightly wider amount of stuff and can only depend on ring 0 dependencies and then ring 2+ is the crapware libraries that infect most ecosystems. But maybe that's not the right fit either. The world where package managers are just open to whatever needs to die. It's no…

In practice, "ring 0" is whatever gets merged into your language's standard library. Node and python both have pretty expansive standard libraries at this point, stepping outside of those is a choice

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#172

Post by raphinou »

I'm working on a multi signature solution that helps to detect unauthorized releases in the case of an account hijack. It is open source, self hostable, accountless and I am looking for feedback!

Website: https://asfaload.com/

GitHub:https://github.com/asfaload/asfaload

Spec: https://github.com/asfaload/spec

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#173

Post by raverbashing »

x0x0 wrote: post #158
notpushkin wrote: post #107

Earlier quoted context omitted.

You mean first 86,400 seconds?

You have to admire the person who designed the flexibility to have 87239 seconds not be old enough, but 87240 to be fine.

This is the difference between thinking about the user experience and thinking just about the technical aspect

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#174

Post by aa-jv »

I have a few projects which rely on npm (and react) and every few months I have to revisit them to do an update and make sure they still build, and I am basically done with npm and the entire ecosystem at this point.

Sure, its convenient to have so much code to use for basic functionality - but the technical debt of having to maintain these projects is just too damn high.

At this point I think that, if I am forced to use javascript or node for a project, I reconsider involvement in that project. Its ecosystem is just so bonkers I can't justify the effort much longer.

There has to be some kind of "code-review-as-a-service" that can be turned on here to catch these things. Its just so unproductive, every single time.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#175

Post by wolvesechoes »

I am glad I don't need to touch JS or web dev at all.

Now, I tend to use Python, Rust and Julia. With Python I am constantly using few same packages like numpy and matplotlib. With Rust and Julia, I try as much as possible to not use any packages at all, because it always scares me when something that should be pretty simple downloads half of the Internet to my PC.

Julia is even worse than Rust in that regard - for even rudimentary stuff like static arrays or properly namespaced enums people download 3rd party packages.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#176

Post by mort96 »

layer8 wrote: post #149
superjan wrote: post #88

Earlier quoted context omitted.

About the use of different units: next time you choose a property name in a config file, include the unit in the name. So not “timeout” but “timeoutMinutes”.

Or require the value to specify a unit.

At that point, you're making all your configuration fields strings and adding another parsing step after the json/toml/yaml parser is done with it. That's not ideal either; either you write a bunch of parsing code (not terribly difficult but not something I wanna do when I can just not), or you use some time library to parse a duration string, in which case the programming language and time library you happen to use suddenly becomes part of your config file specification and you have to exactly re-implement your old time handling library's duration parser if you ever want to switch to a new one or re-implement the tool in another language.

I don't think there are great solutions here. Arguably, units should be supported by the config file format, but existing config file formats don't do that.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#177

Post by tgv »

pjmlp wrote: post #110

The amount of people still using this instead of fetch. Nonetheless when wasn't axios, it would be something else. This is why corporations doing it right don't allow installing the Internet into dev machines. Yet everyone gets to throw their joke about PC virus, while having learnt nothing from it.

Axios has a long history, and is included in a lot of code, also in indirect dependencies. Just check its npm page: it has 174025 dependents as of this moment, including a lot of new packages (I see openclaw and mcp related packages in the list).

And with LLMs generating more and more code, the risk of copying old setups increases.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#178

Post by pglevy »

woeirua wrote: post #52

Supply chain attacks are so scary that I think most companies are going to use agents to hard fork their own versions of a lot of these core libraries instead. It wasn’t practical before. It’s definitely much more doable today.

I was thinking about this as a bull case for human developers. Seems if you're worried enough to do this you're not going to have LLMs write the new code.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#179

Post by cyrusmg »

gib444 wrote: post #140
friendzis wrote: post #98

Earlier quoted context omitted.

> (Side note, it's wild that npm, bun, and pnpm have all decided to use different time units for this configuration.) First day with javascript?

OP should be glad a new time unit wasn't invented

N multiplications of dozen-second

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#180

Post by SoKamil »

layer8 wrote: post #157
nananana9 wrote: post #114

Package managers are a failed experiment. We have libraries like SQLite, which is a single .c file that you drag into your project and it immediately does a ton of incredibly useful, non-trivial work for you, while barely increasing your executable's size. The issue is not dependencies themselves, it's transitive ones. Nobody installs left-pad or is-even-number directly, and "libraries" like these are the vast majori…

For some reason, NPM is the only ecosystem with substantial issues with supply-chain attacks.

Popularity
Post reply on HN