Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

231–240 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#231

Post by dj_mc_merlin »

cleansy wrote: post #218

To have an initial smoke test, why not run a diff between version upgrades, and potentially let an llm summarise the changes? It’s a baffling practice that a lot of developers are just blindly trusting code repos to keep the security standards. Last time I installed some npm package (in a container) it loaded 521 dependencies and my heart rate jumped a bit

Is this the first time you have ever thought about the idea of supply chain attacks? This is the first thought 90% of people have and it doesn't work. Too much work to manually verify diffs and LLMs aren't good enough at this yet.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#232

Post by slopinthebag »

cozzyd wrote: post #136
slopinthebag wrote: post #106

Earlier quoted context omitted.

Cargo is a great package manager and hasn't suffered from the same problems. I'll take it.

Yet. Does cargo contain any mitigations to prevent a similar attack? Now hopefully no distro signing keys have been compromised in the latest attacks...

Yes they do!

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#233

Post by imhoguy »

postalcoder wrote: post #26

PSA: npm/bun/pnpm/uv now all support setting a minimum release age for packages. I also have `ignore-scripts=true` in my ~/.npmrc. Based on the analysis, that alone would have mitigated the vulnerability. bun and pnpm do not execute lifecycle scripts by default. Here's how to set global configs to set min release age to 7 days: ~/.config/uv/uv.toml exclude-newer = "7 days" ~/.npmrc min-release-age=7 # days ignore-scr…

Good luck with any `npm audit` in a pipeline. Sometimes you have to pull the latest release because the previous one had a critical vulnerability.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#234

Post by littlecranky67 »

inbx0 wrote: post #209
strogonoff wrote: post #148

Essential steps to minimise your exposure to NPM supply chain attacks: — Run Yarn in zero-installs mode (or equivalent for your package manager). Every new or changed dependency gets checked in. — Disable post-install scripts. If you don’t, at least make sure your package manager prompts for scripts during install, in which case you stop and look at what it’s going to run. — If third-party code runs in development, i…

> Run Yarn in zero-installs mode (or equivalent for your package manager). Every new or changed dependency gets checked in. Idk, lockfiles provide almost as good protection without putting the binaries in git. At least with `--frozen-lockfile` option.

Exactly. Yarn uses a yarn.lock file with the sha256 hashes of each npm package it downloads from the repo (they are .tgz files). If the hash won't match, install fails. No need to commit the dependencies into your git.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#235

Post by hk__2 »

fluxist wrote: post #215

A command to recursively check for the compromised axios package version: find / -path '*/node_modules/axios/package.json' -type f 2>/dev/null | while read -l f; set -l v (grep -oP '"version"\s*:\s\*"\K(1\.14\.1|0\.30\.4)' $f 2>/dev/null); if test -n "$v"; printf '\a\n\033[1;31m FOUND v%s\033[0m \033[1;33m%s\033[0m\n' $v (string replace '/package.json' '' -- $f); else; printf '\r\033[2m scanning: %s\033[K\033[0m' (st…

Or more simply:

    find / -type f -path '*/node_modules/axios/package.json' \
        -exec grep -Pl '"version"\s*:\s*"(1\.14\.1|0\.30\.4)"' {} + 2>/dev/null
Let’s not encourage people to respond to security incidents by… copy/pasting random commands they don’t understand.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#236

Post by cryptonym »

woeirua wrote: post #52

Supply chain attacks are so scary that I think most companies are going to use agents to hard fork their own versions of a lot of these core libraries instead. It wasn’t practical before. It’s definitely much more doable today.

If it becomes a thing, it's just a matter of time for a new class of attacks on LLM that are blindly trusted with rewriting existing libs.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#239

Post by tisc »

mayama wrote: post #69
bluepeter wrote: post #35

Min release age sucks, but we’ve been here before. Email attachments used to just run wild too, then everyone added quarantine delays and file blocking and other frictions... and it eventually kinda/sorta worked. This does feel worse, though, with fewer chokepoints and execution as a natural part of the expectation. Edit: bottom line is installs are gonna get SOOO much more complicated. You can already see the soluti…

Min release age might just postpone vulnerability to be applied few days later in non trivial cases like this. More I think about it, Odin lang approach of no package manager makes senses. But, for that approach won't work for Javascript as it needs npm package even for trivial things. Even vendoring approach like golang won't work with Javascript with the amount of churn and dependencies.

It does not _need_ it, that’s the thing. It has become a custom to import a dependency for a lot of things. Especially for JavaScript.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#240

Post by antiloper »

croemer wrote: post #212

I lost respect for Axios when they made a breaking change in a patch release. Digging into the root cause, I found the maintainer had approved an outside PR with an obvious AI slop PR description: https://github.com/axios/axios/issues/7059 Looks like the maintainer wasn't just careless when reviewing PRs.

That maintainer (also the one whose creds got stolen) also has an obvious chatgpt slop profile picture on github.
Post reply on HN