Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

441–450 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#441

Post by woodruffw »

sbarre wrote: post #433
woodruffw wrote: post #421

Earlier quoted context omitted.

It should work for global configuration too, please file an issue if you’re observing otherwise. (Make sure you’re on a version that actually supports relative times, please!)

This is what tripped me up. I added that config and then got this error: error: Failed to parse: `.config/uv/uv.toml` Caused by: TOML parse error at line 1, column 17 | 1 | exclude-newer = "7 days" | ^^^^^^^^ failed to parse year in date "7 days": failed to parse "7 da" as year (a four digit integer): invalid digit, expected 0-9 but got I was on version 0.7.20, so I removed that line, ran "uv self update" and upgrade…

Yeah, that error message isn’t ideal on older versions, but unfortunately there’s no way to really address that. But I’m glad it’s working for you on newer versions.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#442

Post by pier25 »

afavour wrote: post #370
bob1029 wrote: post #241

"Batteries included" ecosystems are the only persistent solution to the package manager problem. If your first party tooling contains all the functionality you typically need, it's possible you can be productive with zero 3rd party dependencies. In practice you will tend to have a few, but you won't be vendoring out critical things like HTTP, TCP, JSON, string sanitation, cryptography. These are beacons for attackers…

Irony is that Node has no need for Axios, native fetch support has been there for years, so in terms of network requests it is batteries included.

People use axios or ky because with fetch you inevitably end up writing a small wrapper on top of it anyway.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#443

Post by MattDaEskimo »

woodruffw wrote: post #431

There’s a recurrent pattern with these package compromises: the attacker exfiltrates credentials during an initial phase, then pivots to the next round of packages using those credentials. That’s how we saw them make the Trivy to LiteLLM leap (with a 5 day gap), and it’ll almost certainly be similar in this case. The solution to this is twofold, and is already implemented in the primary ecosystems being targeted (Pyt…

There are solutions, the problem is almost always discipline.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#444

Post by TZubiri »

red_admiral wrote: post #305

There's a package manager discussion, but the bit that stands out to me is that this started with a credential compromise. At some point when a project gets big enough like axios, maybe the community could chip in to buy the authors a couple of YubiHSM or similar. I wish that _important keys live in hardware_ becomes more standard given the stakes. Dealing with dependencies is another question; if it's stupid stuff l…

>maybe the community could chip in to buy the authors a couple of YubiHSM

There's no community, the users of axios are devs that looked at stackoverflow for "how to download a file in javascript", they barely know or care what axios is.

Now the users of axios are devs that ask Claude Code or Codex to scrape a website or make a dashboard, they don't even know about the word axios.

I personally had to delete axios a couple of time from my codebase when working with junior devs.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#445

Post by afavour »

pier25 wrote: post #442
afavour wrote: post #370

Earlier quoted context omitted.

Irony is that Node has no need for Axios, native fetch support has been there for years, so in terms of network requests it is batteries included.

People use axios or ky because with fetch you inevitably end up writing a small wrapper on top of it anyway.

Some might say the tradeoff of writing a small wrapper is worth it given what’s been demonstrated here.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#446

Post by johnisgood »

withinboredom wrote: post #254
weird-eye-issue wrote: post #108

Earlier quoted context omitted.

timeoutMs is shorter ;) You guys can't appreciate a bad joke

timoutμs is even better. People will learn how to type great symbols.

Yes timout indeed!

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#447

Post by TZubiri »

jmward01 wrote: post #33

This may not be popular, but is there a place for required human actions or just timed actions to slow down things like this? For instance, maybe a GH action to deploy requires a final human click and to change that to cli has a 3 day cooling period with mandatory security emails sent out. Similarly, you switch to read only for 6 hrs after an email change. There are holes in these ideas but the basic concept is to tr…

lgtm (didn't read)

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#448

Post by [deleted] »

invaliduser wrote: post #414
troad wrote: post #347

Earlier quoted context omitted.

Ah, so you've traded the possibility of bad dependencies for certainty.

How can you come to that conclusion, given the specific examples I have given, which are tedious to write, but easy to proof-read and test?

[deleted]

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#449

Post by woodruffw »

MattDaEskimo wrote: post #443
woodruffw wrote: post #431

There’s a recurrent pattern with these package compromises: the attacker exfiltrates credentials during an initial phase, then pivots to the next round of packages using those credentials. That’s how we saw them make the Trivy to LiteLLM leap (with a 5 day gap), and it’ll almost certainly be similar in this case. The solution to this is twofold, and is already implemented in the primary ecosystems being targeted (Pyt…

There are solutions, the problem is almost always discipline.

I don’t know what this means. Discipline is good, but I think you need to have good tools/primitives in place to help people exercise discipline.

(The classic example being passwords: we wouldn’t need MFA is everybody just “got good” and used strong/unique passwords everywhere. But that’s manifestly unrealistic, so instead we use our discipline budget on getting people to use password managers and phishing-resistant MFA.)

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#450

Post by johnisgood »

wongarsu wrote: post #323
cozzyd wrote: post #64

Earlier quoted context omitted.

that's why people are telling others to use 7 days but using 8 days themselves :)

brb, switching everything to 9 days

That is 3D chess level type shit. xD
Post reply on HN