Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Axios compromised on NPM – Malicious versions drop remote access trojan

stepsecurity.io

Post reply on HN
Print view View original

711–720 of 894 posts

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#711

Post by diablevv »

Groxx wrote: post #687
rhdunn wrote: post #674

Earlier quoted context omitted.

There are several issues with "Batteries Included" ecosystems (like Python, C#/.NET, and Java): 1. They are not going to include everything. This includes things like new file formats. 2. They are going to be out of date whenever a standard changes (HTML, etc.), application changes (e.g. SQLite/PostgreSQL/etc. for SQL/ORM bindings), or API changes (DirectX, Vulcan, etc.). 3. Things like data structures, graphics APIs…

"Batteries included" means "ossification is guaranteed", yah. "stdlib is where code goes to die" is a fairly common phrase for a reason. There's clearly merit to both sides, but personally I think a major underlying cause is that libraries are trusted . Obviously that doesn't match reality. We desperately need a permission system for libraries, it's far harder to sneak stuff in when doing so requires an "adds dangero…

[dead]

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#712

Post by _alternator_ »

oasisbob wrote: post #673
_alternator_ wrote: post #590

Earlier quoted context omitted.

Leap seconds are their own nightmare. UNIX time ignores them, btw, so that the unix epoch is 86400*number of days since 1/1/1970 + number of seconds since midnight. The behavior at the instance of a leap second is undefined.

That's a good way of describing that. It's far too easy to pretend UNIX timestamps would correspond to a stopwatch counting from 1/1/1970.

Right. Currently epoch time is off the stopwatch time by 27 seconds.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#713

Post by kube-system »

jmull wrote: post #508
pier25 wrote: post #442

Earlier quoted context omitted.

People use axios or ky because with fetch you inevitably end up writing a small wrapper on top of it anyway.

In my experience people feel the need to wrap axios too.

These are the kind of people I hope AI replaces

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#714

Post by themafia »

habinero wrote: post #664
themafia wrote: post #71

Earlier quoted context omitted.

Why not just release escrow? If I try to push a new release version another developer or developers have to agree to that release. In larger projects you would expect the release to be coordinated or scheduled anyways. Effectively we're just moving "version pinning" or "version delay" one layer up the release chain.

A lot of libraries are maintained by a single person.

Are those the ones typically involved in supply chain attacks?

There are no perfect solutions; but, let's be reasonable.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#715

Post by kube-system »

nailer wrote: post #570
augusto-moura wrote: post #476

Earlier quoted context omitted.

Hm, I don't think axios would do much better here. `fetch` is the official replacement for axios. If both are flawed that's another topic

> `fetch` is the official replacement for axios. No. Axios is still maintained. They have not deprecated the project in favor of fetch.

It's not deprecated, it's obsoleted.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#717

Post by msdz »

throwaway2037 wrote: post #656
wongarsu wrote: post #327

Earlier quoted context omitted.

> In practice you will tend to have a few, but you won't be vendoring out critical things like HTTP, TCP, JSON, string sanitation, cryptography Unless you are Python, where the standard library includes multiple HTTP libraries and everyone installs the requests package anyways. Few languages have good models for evolving their standard library, so you end up with lots of bad designs sticking around forever. Libraries…

> Few languages have good models for evolving their standard library Can you name some examples?

Personally I've heard Odin [1] to do a decent job with this, at least from what I've superficially learned about its stdlib and included modules as an "outsider" (not a regular user). It appears to have things like support for e.g. image file formats built-in, and new things are somewhat liberally getting added to core if they prove practically useful, since there isn't a package manager in the traditional sense. Here's a blog post by the language author literally named "Package Managers are Evil" [2]

(Please do correct me if this is wrong, again, I don't have the experience myself.)

[1] https://pkg.odin-lang.org/

[2] https://www.gingerbill.org/article/2025/09/08/package-manage...

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#718

Post by sieabahlpark »

kube-system wrote: post #715
nailer wrote: post #570

Earlier quoted context omitted.

> `fetch` is the official replacement for axios. No. Axios is still maintained. They have not deprecated the project in favor of fetch.

It's not deprecated, it's obsoleted.

[dead]

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#719

Post by Xirdus »

moralestapia wrote: post #595
Xirdus wrote: post #501

Earlier quoted context omitted.

I'm old enough to remember computers being pitched as devices that can do tedious math for us. Now we have to do tedious math for them apparently.

Hey that's a great joke, you made me spill my morning home-brewed kombucha. I'm going to steal that one for my JavaScript monthly developers meetup. Is it ok if I attribute it to "Xirdus on Hacker News"?

Lol sure.

Re: Axios compromised on NPM – Malicious versions drop remote access trojan

#720

Post by Xirdus »

darepublic wrote: post #548
Xirdus wrote: post #501

Earlier quoted context omitted.

I'm old enough to remember computers being pitched as devices that can do tedious math for us. Now we have to do tedious math for them apparently.

I'm sure you would like to memorize all kinds of API instead of having something idiot proof and straightforward

As if `minimumReleaseAge` in `[install]` section of `.bunfig.toml` doesn't require the same kind of memorization.
Post reply on HN