News for hackers. Stuff that matters.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by friendzis on Tuesday March 31, 2026 @01:35AM (#47583126)
> (Side note, it's wild that npm, bun, and pnpm have all decided to use different time units for this configuration.)

First day with javascript?

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by notpushkin on Tuesday March 31, 2026 @01:47AM (#47583201)
You mean first 86,400 seconds?
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by x0x0 on Tuesday March 31, 2026 @02:45AM (#47583592)
You have to admire the person who designed the flexibility to have 87239 seconds not be old enough, but 87240 to be fine.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by raverbashing on Tuesday March 31, 2026 @03:01AM (#47583720)
This is the difference between thinking about the user experience and thinking just about the technical aspect
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by zelphirkalt on Tuesday March 31, 2026 @05:42AM (#47584866)
I actually think it is not too bad a design, because seconds are the SI base unit for time. Putting something like "x days" requires additional parsing steps and therefore complexity in the implementation. Either knowing or calculating how many seconds there are in a day can be expected of anyone touching a project or configuration at this level of detail.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by wongarsu on Tuesday March 31, 2026 @06:27AM (#47585229)
Seconds are also unambiguous. Depending on your chosen definition, "X days" may or may not be influenced by leap seconds and DST changes.

I doubt anyone cares about an hour more or less in this context. But if you want multiple implementations to agree talking about seconds on a monotonic timer is a lot simpler

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by sverhagen on Tuesday March 31, 2026 @08:11AM (#47586173)
I came here to argue the opposite. Expressing it in seconds takes away questions about time zones and DST.

I think you're incorrect to say that second are also ambiguous. Maybe what you mean is that days are more practical, but that seems very much a personal preference.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by pavel_lishin on Tuesday March 31, 2026 @09:18AM (#47586953)
I think you misread the comment you're replying to.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by friendzis on Tuesday March 31, 2026 @11:08AM (#47588479)
I understand the [flawed] reasoning behind "x seconds from now is going to be roughly now() + x on this particular system", but how does defining the cooldown from an external timestamp save you from dealing with DST and other time shenanigans? In the end you are comparing two timestamps and that comparison is erroneous without considering time shenanigans
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by woodruffw on Tuesday March 31, 2026 @10:12AM (#47587689)
Could you explain what you mean re: ambiguity? I understand why “calendar units” like months are ambiguous, but minutes, hours, days, and weeks all have fixed durations (which is why APIs like Python’s `timedelta` allows them).
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by nightpool on Tuesday March 31, 2026 @10:22AM (#47587812)
The minute between December 31, 2016 23:59 and January 1st 2017 is 61 seconds, not 60 seconds. The hour that contains that minute is 3601 seconds, the day that contains that hour is 43201 seconds, etc. If you assume a fixed duration and simply multiply by 43200, your math will be wrong compared to the rest of the world.

Daylight savings time makes a day take 23 hours or 25 hours. That makes a week take 7254000 seconds or 7261200 seconds. Etc.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by woodruffw on Tuesday March 31, 2026 @10:30AM (#47587932)
That’s what I mean by calendar units. These aren’t issues if you don’t try to apply durations to the “real” calendar.

(This is all in the context of cooldowns, where I’m not convinced the there’s any real ambiguity risk by allowing the user to specify a duration in day or hour units rather than seconds. In that context a day is exactly 24 hours, regardless of what your local savings time rules are.)

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by wongarsu on Tuesday March 31, 2026 @11:18AM (#47588623)
"exactly 24 hours" could still be anywhere between 86399 and 86401 seconds, depending on leap seconds. At least if by an hour you mean an interval of 60 minutes, because a minute that contains a leap second will have either 59 or 61 seconds.

You could specify that for the purposes of cooldowns you want "hour" to mean an interval of 3600 seconds. But that you have to specify that should illustrate how ambiguous the concept of an hour is. It's not a useless concept by any means and I far prefer to specify duration in hours and days, but you have to spend a sentence or two on defining which definition of hours and days you are using. Or you don't and just hope nobody cares enough about the exact cooldown duration

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by hunter2_ on Wednesday April 01, 2026 @10:52AM (#47601744)
If you say "wait 1 day without using a calendar+locale" then the duration is unambiguously 86400s, but if you say "wait 1 day using a calendar+locale" or "wait until this time tomorrow" then the duration is ambiguous until you've incorporated rules like leap/DST. I think GP's point is that "wait 1 day" unambiguously defaults to the former, and you disagree, but perhaps it's a reasonable default.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by woodruffw on Wednesday April 01, 2026 @11:02AM (#47601880)
Yep, this is exactly my point. Durations are abstract spans of "stopwatch time," they don't adhere to local times or anything else we use as humans to make time more useful to us. In that context there's no real ambiguity to using units like hours/days/weeks (but not months, etc.) because they have unambiguous durations.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by hunter2_ on Sunday April 05, 2026 @10:44AM (#47649975)
Now you've got me wondering something: if a "stopwatch month" can't exist since everyone agrees that different months have different durations (and therefore you must select one like "the month of January" to know how long to run the stopwatch), isn't there an argument that a "stopwatch year" has the same need to select one since everyone agrees that different years have different day counts (unless we mean a solar year in seconds, not quantized to the nearest day, but that's probably a Bad Default)?

The collective human decision to make days-per-year vary (requiring leap rules to calculate days) seems similar to the collective human decision to make days-per-month vary (requiring month names to calculate days). So if we say a "stopwatch year" suffers the same fate as the "stopwatch month" then it's a slippery slope to saying the "stopwatch minute" is no different than a "stopwatch year" (requiring leap rules to calculate seconds) even if, for all practical purposes, it seems exempt.

I guess this is why we make "second" the SI unit, and none of our human-convenience rules mess with the duration of a second. A leap second changes the duration of a minute (and above), and a leap year changes the duration of a month (and above). Which, oddly enough, demonstrates an inconsistency: we ought to say "leap day" instead of "leap year" if the thing being added will follow the word "leap."

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by _alternator_ on Tuesday March 31, 2026 @11:30AM (#47588850)
Leap seconds are their own nightmare. UNIX time ignores them, btw, so that the unix epoch is 86400*number of days since 1/1/1970 + number of seconds since midnight. The behavior at the instance of a leap second is undefined.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by adrianN on Tuesday March 31, 2026 @12:07PM (#47589481)
Undefined behavior is worse than complicated defined behavior imo.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by oasisbob on Tuesday March 31, 2026 @01:18PM (#47590572)
That's a good way of describing that. It's far too easy to pretend UNIX timestamps would correspond to a stopwatch counting from 1/1/1970.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by _alternator_ on Tuesday March 31, 2026 @02:43PM (#47591682)
Right. Currently epoch time is off the stopwatch time by 27 seconds.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by jon-wood on Tuesday March 31, 2026 @10:21AM (#47587798)
In the UK last Sunday was 23 hours long because we switched to BST, and occasionally leap seconds will result in a minute being something other 60 seconds.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by extraduder_ire on Tuesday March 31, 2026 @01:02PM (#47590325)
No it wasn't. The country instantaneously changed timezones from UTC+0 to UTC+1 (called something else locally), it was no different to any other timezone change from e.g. physically moving into another timezone.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by myhf on Tuesday March 31, 2026 @12:16PM (#47589646)
exploiting the ambiguity in date formats by releasing a package during a leap second
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by rolux on Tuesday March 31, 2026 @07:38AM (#47585865)
> seconds are the SI base unit for time

True. But seconds are not the base unit for package compromises coming to light. The appropriate unit for that is almost certainly days.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by PunchyHamster on Tuesday March 31, 2026 @08:22AM (#47586278)
that kind of complexity is always worth it. Every single time. It's user time that you're saving and it also makes config clearer for readers and cuts out on "too many/little zeroes on accident" errors

It's just library for handling time that 98% of the time your app will be using for something else.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by x0x0 on Tuesday March 31, 2026 @12:40PM (#47590012)
I find it best when I need a calculator to understand security settings. 604800 here we come
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by dspillett on Tuesday March 31, 2026 @10:03AM (#47587565)
Probably went with the simplest implementation, if starting from the current “seconds since epoch” value. Let the user do any calculations needed to translate three days into that measurement.

It also efficiently annoys the most people at once: those what want hours will complain if they set it to days, thought that want days will complain if hours are used. By using minutes or seconds you can wind up both segments while not offend those who rightly don't care because they can cope with a little arithmetic :)

Though doing what sleep(1) does would be my preference: default to seconds but allow m/h/d to be added to change that.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Xirdus on Tuesday March 31, 2026 @10:13AM (#47587701)
I'm old enough to remember computers being pitched as devices that can do tedious math for us. Now we have to do tedious math for them apparently.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by dspillett on Tuesday March 31, 2026 @10:22AM (#47587811)
Hence the way I would do it (and have for other purposes), as stated in my final sentence. Have the human state the intent and convert to your own internally preferred units as needed.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by darepublic on Tuesday March 31, 2026 @11:00AM (#47588329)
I'm sure you would like to memorize all kinds of API instead of having something idiot proof and straightforward
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Xirdus on Tuesday March 31, 2026 @02:59PM (#47591902)
As if `minimumReleaseAge` in `[install]` section of `.bunfig.toml` doesn't require the same kind of memorization.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by moralestapia on Tuesday March 31, 2026 @11:33AM (#47588890)
Hey that's a great joke, you made me spill my morning home-brewed kombucha.

I'm going to steal that one for my JavaScript monthly developers meetup.

Is it ok if I attribute it to "Xirdus on Hacker News"?

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Xirdus on Tuesday March 31, 2026 @02:57PM (#47591866)
Lol sure.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by OJFord on Tuesday March 31, 2026 @04:05PM (#47592730)
No no no, see now we just say "computer! do tedious math!", and it will do some slightly different math for us and compliment us on having asked it to do so.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by fc417fc802 on Tuesday March 31, 2026 @10:40AM (#47588046)
The one true unit of time is hexadecimal encoded nanoseconds since the unix epoch. (I'm only half joking because I actually have authored code that used that before.)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by scoutt on Tuesday March 31, 2026 @11:34AM (#47588910)
Well, you have 1000000 microseconds in between. That's a big threshold.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by pwillia7 on Tuesday March 31, 2026 @10:31AM (#47587938)
wait what if we start on a day DST starts or ends????
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by gib444 on Tuesday March 31, 2026 @02:21AM (#47583426)
OP should be glad a new time unit wasn't invented
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by friendzis on Tuesday March 31, 2026 @03:31AM (#47583916)
Workdays! Think about it, if you set the delay in regular days/seconds the updated dependency can get pulled in on a weekend with only someone maybe on-call.

(Hope your timezones and tzdata correctly identifies Easter bank holiday as non-workdays)

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by yohannesk on Tuesday March 31, 2026 @04:07AM (#47584134)
And we also need localization. Each country can have their own holidays
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by rolandog on Tuesday March 31, 2026 @04:35AM (#47584345)
And we need groups of locales for teams that are split across multiple locations; e.g.:

  new_date = add_workdays(
    workdays=1.5,
    start=datetime.now(),
    regions=["es", "mx", "nl", "us"],
  )
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by mewpmewp2 on Tuesday March 31, 2026 @04:59AM (#47584525)
Hopefully "es" will have Siesta support too.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by zdc1 on Tuesday March 31, 2026 @04:51AM (#47584469)
Might be better to calculate them separately for each locale and then tie-break with your own approach (min/max/avg/median/etc.)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by wongarsu on Tuesday March 31, 2026 @06:30AM (#47585263)
Don't forget about regional holidays, which might follow arbitrary borders that don't match any of the official subdivisions of the country. Or may even depend on the chosen faith of the worker
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by reaperducer on Tuesday March 31, 2026 @09:01AM (#47586754)
Pulaski day in Illinois. Or Reds Opening Day in Cincinnati.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday March 31, 2026 @04:24AM (#47584263)
> Workdays!

This is javascript, not Java.

In JavaScript something entirely new would be invented, to solve a problem that has long been solved and is documented in 20+ year old books on common design patterns. So we can all copy-paste `{ or: [{ days: 42, months: 2, hours: "DEFAULT", minutes: "IGNORE", seconds: null, timezone: "defer-by-ip" }, { timestamp: 17749453211*1000, unit: "ms"}]` without any clue as to what we are defining.

In Java, a 6000LoC+ ecosystem of classes, abstractions, dependency-injectables and probably a new DSL would be invented so we can all say "over 4 Malaysian workdays"

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by mikeryan on Tuesday March 31, 2026 @08:13AM (#47586191)
JavaScript Temporal. Not sure knowing what a "workday" is in each timezone is in it's scope but it's the much needed and improved JS, date API (granted with limited support to date)

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by whatisthiseven on Tuesday March 31, 2026 @04:41AM (#47584388)
But you know that Java solution will continue working even after we no longer use the Gregorian Calendar, the collapse and annexation of Malaysia to some foreign power, and then us finally switching to a 4-day work week; so it'd be worth it.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by nesarkvechnep on Tuesday March 31, 2026 @05:18AM (#47584698)
It probably won’t work correctly from the get go. But it can be debugged everywhere so that’s good.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday March 31, 2026 @06:29AM (#47585245)
... and since it was architectured to allow runtime injection-patching of events before they hit the enterprise-service-bus, everyone using this library must first set fourteen ENV vars in their profile, and provide a /etc/java/springtime/enterprise-workday-handling/parse-event-mismatch.jar.patch. Which should fix the bug for you.

You can find the patch files for your OSs by registering at Oracle with a J3EE8.4-PatchLibID (note, the older J3EE16-PatchLib-ids aren't compatible), attainable from your regional Oracle account-manager.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by hluska on Tuesday March 31, 2026 @08:54AM (#47586666)
This isn’t even remotely funny.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by pcblues on Tuesday March 31, 2026 @11:19AM (#47588645)
I am laughing. I'm not even near the end of this thread.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by xorcist on Tuesday March 31, 2026 @09:54AM (#47587437)
And least one of those environment can contain template strings that are expanded with arguments from request headers when run under popular enterprise java frameworks, and by way of the injection patching could hot load arbitrary code in runtime.

A joke should be funny though, not just a dry description of real life, so let's leave it at that. We've already taken it too far.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by PunchyHamster on Tuesday March 31, 2026 @08:23AM (#47586292)
In before someone thinks it's a joke, the most commonly used logging library in Java had LDAP support in format scripts enabled by default" (which resulted, of course in CVE)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by myhf on Tuesday March 31, 2026 @12:19PM (#47589697)
There's an extra digit in your timestamp.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday April 07, 2026 @03:06PM (#47679900)
Ah but you don't know how far in the future I intended it to be :)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by sverhagen on Tuesday March 31, 2026 @08:15AM (#47586212)
Why would it get pulled in over the weekend? What automatic deployments are you running if there also isn't a human working to get it out?

Do you run automatic dependency updates over the weekend? Wouldn't you rather do that during fully-staffed hours?

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by ecshafer on Tuesday March 31, 2026 @09:43AM (#47587302)
When I worked in Finance our internal Date extension did actually have Workdays that took into account Stock Market and Bank Holidays.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by tsukikage on Tuesday March 31, 2026 @11:07AM (#47588457)
…now imagine a list of instruments, some of which have durations specified in days/weeks/months (problems already with the latter) and some in workdays, and the user just told your app to display it sorted by duration.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by brunoarueira on Tuesday March 31, 2026 @11:31AM (#47588858)
Me too, it was just a constant filled with bank holidays for the next 6 years
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by matltc on Tuesday March 31, 2026 @11:12AM (#47588532)
I tried to write this function in Power Query (Excel hell). Gave up after an hour or so.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by dspillett on Tuesday March 31, 2026 @10:07AM (#47587618)
Nah, working hours and make global assumptions of 0900-1230/1330-1730, M-F, and have an overly convoluted way to specify what working ours actually are in the relevant location(s).
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by ghurtado on Tuesday March 31, 2026 @04:10AM (#47584156)
If we're taking suggestions, I'd like to propose "parsec" (not to be confused with the unit of distance of the same name)

That way Han Solo can make sense in the infamous quote.

EDIT: even Gemini gets this wrong:

> In Star Wars, a parsec is a unit of distance, not time, representing approximately 3.26 light-years

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by latexr on Tuesday March 31, 2026 @04:31AM (#47584318)
> That way Han Solo can make sense in the infamous quote.

They explained it in the Solo movie.

https://www.reddit.com/r/MovieDetails/comments/ah3ptm/solo_a...

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by slavik81 on Tuesday March 31, 2026 @08:01AM (#47586087)
That had more or less been the explanation in the books for decades, and even in George Lucas' notes from 1977:

> It's a very simple ship, very economical ship, although the modifications he made to it are rather extensive – mostly to the navigation system to get through hyperspace in the shortest possible distance (parsecs).

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by binarymax on Tuesday March 31, 2026 @06:52AM (#47585455)
Making a whole movie just to retcon the parsec misuse in Ep IV was a choice
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by latexr on Tuesday March 31, 2026 @08:01AM (#47586093)
They made a movie to make money. I doubt anyone holding the purse strings cared one iota if that bit were corrected or not. It’s not really a retcon either because they didn’t change anything.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by inopinatus on Tuesday March 31, 2026 @08:33AM (#47586410)
It was already fine, because it’s a metric defined on a submanifold of relativistic spacetime.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by slowmovintarget on Tuesday March 31, 2026 @09:29AM (#47587082)
Parallax arc-second -> distance.

For Star Wars, they retconned it to mean he found the shortest possible route through dangerous space, so even for Han Solo's quote, it's still distance.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by cyrusmg on Tuesday March 31, 2026 @03:09AM (#47583768)
N multiplications of dozen-second
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by vasco on Tuesday March 31, 2026 @05:48AM (#47584903)
To me it sounds safer to have different big infra providers with different delays, otherwise you still hit everyone at the same time when something does inevitably go undetected.

And the chances of staying undetected are higher if nobody is installing until the delay time ellapses.

It's the same as not scheduling all cronjobs to midnight.