News for hackers. Stuff that matters.

A comment on Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan. Parent comment

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by otterley on Tuesday March 31, 2026 @12:42AM (#47582838)
What do you base that on? Threat researchers (and their automated agents) will still keep analyzing new releases as soon as they’re published.
[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by mike_hearn on Tuesday March 31, 2026 @04:33AM (#47584335)
Their analysis was triggered by open source projects upgrading en-masse and revealing a new anomalous endpoint, so, it does require some pioneers to take the arrows. They didn't spot the problem entirely via static analysis, although with hindsight they could have done (missing GitHub attestation).
[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by narrator on Tuesday March 31, 2026 @05:14AM (#47584668)
A security company could set up a honeypot machine that installs new releases of everything automatically and have a separate machine scan its network traffic for suspicious outbound connections.
[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by mike_hearn on Tuesday March 31, 2026 @10:16AM (#47587747)
The problem is what counts as suspicious. StepSecurity are quite clear in their post that they decide what counts as anomalous by comparing lots of open source runs against prior data, so they can't figure it out on their own.
[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by staticassertion on Tuesday March 31, 2026 @07:01AM (#47585545)
> What do you base that on?

The entire history of malware lol

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by otterley on Tuesday March 31, 2026 @10:04AM (#47587576)
Can you elaborate? Why do you believe that motivated threat hunters won’t continue to analyze and find threats in new versions of open source software in the first week after release?
[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by staticassertion on Tuesday March 31, 2026 @10:08AM (#47587630)
Attackers going "low and slow" when they know they're being monitored is just standard practice.

> Why do you believe that motivated threat hunters won’t continue to analyze and find threats in new versions of open source software in the first week after release?

I'm sure they will, but attackers will adapt. And I'm really unconvinced that these delays are really going to help in the real world. Imagine you rely on `popular-dependency` and it gets compromised. You have a cooldown, but I, the attacker, issue "CVE-1234" for `popular-dependency`. If you're at a company you now likely have a compliance obligation to patch that CVE within a strict timeline. I can very, very easily pressure you into this sort of thing.

I'm just unconvinced by the whole idea. It's fine, more time is nice, but it's not a good solution imo.

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by otterley on Tuesday March 31, 2026 @10:23AM (#47587842)
What, in your view, is a better solution?
[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by staticassertion on Tuesday March 31, 2026 @11:12AM (#47588535)
There are many options. Here's a post just briefly listing a few of the ones that would be handled by package managers and registries, but there are also many things that would be best done in CI pipelines as well.

https://news.ycombinator.com/item?id=47586241

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by PunchyHamster on Tuesday March 31, 2026 @08:25AM (#47586308)
The fact threat researchers and especially their automated agents are not all that good at their jobs
[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by zwily on Tuesday March 31, 2026 @09:19AM (#47586970)
Those threat researchers and their autonomous agents caught this axios release.
[ Parent | on HN ]