News for hackers. Stuff that matters.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by gib444 on Tuesday March 31, 2026 @02:21AM (#47583426)
OP should be glad a new time unit wasn't invented
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by friendzis on Tuesday March 31, 2026 @03:31AM (#47583916)
Workdays! Think about it, if you set the delay in regular days/seconds the updated dependency can get pulled in on a weekend with only someone maybe on-call.

(Hope your timezones and tzdata correctly identifies Easter bank holiday as non-workdays)

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by yohannesk on Tuesday March 31, 2026 @04:07AM (#47584134)
And we also need localization. Each country can have their own holidays
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by rolandog on Tuesday March 31, 2026 @04:35AM (#47584345)
And we need groups of locales for teams that are split across multiple locations; e.g.:

  new_date = add_workdays(
    workdays=1.5,
    start=datetime.now(),
    regions=["es", "mx", "nl", "us"],
  )
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by mewpmewp2 on Tuesday March 31, 2026 @04:59AM (#47584525)
Hopefully "es" will have Siesta support too.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by zdc1 on Tuesday March 31, 2026 @04:51AM (#47584469)
Might be better to calculate them separately for each locale and then tie-break with your own approach (min/max/avg/median/etc.)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by wongarsu on Tuesday March 31, 2026 @06:30AM (#47585263)
Don't forget about regional holidays, which might follow arbitrary borders that don't match any of the official subdivisions of the country. Or may even depend on the chosen faith of the worker
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by reaperducer on Tuesday March 31, 2026 @09:01AM (#47586754)
Pulaski day in Illinois. Or Reds Opening Day in Cincinnati.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday March 31, 2026 @04:24AM (#47584263)
> Workdays!

This is javascript, not Java.

In JavaScript something entirely new would be invented, to solve a problem that has long been solved and is documented in 20+ year old books on common design patterns. So we can all copy-paste `{ or: [{ days: 42, months: 2, hours: "DEFAULT", minutes: "IGNORE", seconds: null, timezone: "defer-by-ip" }, { timestamp: 17749453211*1000, unit: "ms"}]` without any clue as to what we are defining.

In Java, a 6000LoC+ ecosystem of classes, abstractions, dependency-injectables and probably a new DSL would be invented so we can all say "over 4 Malaysian workdays"

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by mikeryan on Tuesday March 31, 2026 @08:13AM (#47586191)
JavaScript Temporal. Not sure knowing what a "workday" is in each timezone is in it's scope but it's the much needed and improved JS, date API (granted with limited support to date)

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by whatisthiseven on Tuesday March 31, 2026 @04:41AM (#47584388)
But you know that Java solution will continue working even after we no longer use the Gregorian Calendar, the collapse and annexation of Malaysia to some foreign power, and then us finally switching to a 4-day work week; so it'd be worth it.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by nesarkvechnep on Tuesday March 31, 2026 @05:18AM (#47584698)
It probably won’t work correctly from the get go. But it can be debugged everywhere so that’s good.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday March 31, 2026 @06:29AM (#47585245)
... and since it was architectured to allow runtime injection-patching of events before they hit the enterprise-service-bus, everyone using this library must first set fourteen ENV vars in their profile, and provide a /etc/java/springtime/enterprise-workday-handling/parse-event-mismatch.jar.patch. Which should fix the bug for you.

You can find the patch files for your OSs by registering at Oracle with a J3EE8.4-PatchLibID (note, the older J3EE16-PatchLib-ids aren't compatible), attainable from your regional Oracle account-manager.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by hluska on Tuesday March 31, 2026 @08:54AM (#47586666)
This isn’t even remotely funny.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by pcblues on Tuesday March 31, 2026 @11:19AM (#47588645)
I am laughing. I'm not even near the end of this thread.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by xorcist on Tuesday March 31, 2026 @09:54AM (#47587437)
And least one of those environment can contain template strings that are expanded with arguments from request headers when run under popular enterprise java frameworks, and by way of the injection patching could hot load arbitrary code in runtime.

A joke should be funny though, not just a dry description of real life, so let's leave it at that. We've already taken it too far.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by PunchyHamster on Tuesday March 31, 2026 @08:23AM (#47586292)
In before someone thinks it's a joke, the most commonly used logging library in Java had LDAP support in format scripts enabled by default" (which resulted, of course in CVE)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by myhf on Tuesday March 31, 2026 @12:19PM (#47589697)
There's an extra digit in your timestamp.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday April 07, 2026 @03:06PM (#47679900)
Ah but you don't know how far in the future I intended it to be :)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by sverhagen on Tuesday March 31, 2026 @08:15AM (#47586212)
Why would it get pulled in over the weekend? What automatic deployments are you running if there also isn't a human working to get it out?

Do you run automatic dependency updates over the weekend? Wouldn't you rather do that during fully-staffed hours?

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by ecshafer on Tuesday March 31, 2026 @09:43AM (#47587302)
When I worked in Finance our internal Date extension did actually have Workdays that took into account Stock Market and Bank Holidays.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by tsukikage on Tuesday March 31, 2026 @11:07AM (#47588457)
…now imagine a list of instruments, some of which have durations specified in days/weeks/months (problems already with the latter) and some in workdays, and the user just told your app to display it sorted by duration.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by brunoarueira on Tuesday March 31, 2026 @11:31AM (#47588858)
Me too, it was just a constant filled with bank holidays for the next 6 years
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by matltc on Tuesday March 31, 2026 @11:12AM (#47588532)
I tried to write this function in Power Query (Excel hell). Gave up after an hour or so.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by dspillett on Tuesday March 31, 2026 @10:07AM (#47587618)
Nah, working hours and make global assumptions of 0900-1230/1330-1730, M-F, and have an overly convoluted way to specify what working ours actually are in the relevant location(s).
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by ghurtado on Tuesday March 31, 2026 @04:10AM (#47584156)
If we're taking suggestions, I'd like to propose "parsec" (not to be confused with the unit of distance of the same name)

That way Han Solo can make sense in the infamous quote.

EDIT: even Gemini gets this wrong:

> In Star Wars, a parsec is a unit of distance, not time, representing approximately 3.26 light-years

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by latexr on Tuesday March 31, 2026 @04:31AM (#47584318)
> That way Han Solo can make sense in the infamous quote.

They explained it in the Solo movie.

https://www.reddit.com/r/MovieDetails/comments/ah3ptm/solo_a...

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by slavik81 on Tuesday March 31, 2026 @08:01AM (#47586087)
That had more or less been the explanation in the books for decades, and even in George Lucas' notes from 1977:

> It's a very simple ship, very economical ship, although the modifications he made to it are rather extensive – mostly to the navigation system to get through hyperspace in the shortest possible distance (parsecs).

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by binarymax on Tuesday March 31, 2026 @06:52AM (#47585455)
Making a whole movie just to retcon the parsec misuse in Ep IV was a choice
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by latexr on Tuesday March 31, 2026 @08:01AM (#47586093)
They made a movie to make money. I doubt anyone holding the purse strings cared one iota if that bit were corrected or not. It’s not really a retcon either because they didn’t change anything.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by inopinatus on Tuesday March 31, 2026 @08:33AM (#47586410)
It was already fine, because it’s a metric defined on a submanifold of relativistic spacetime.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by slowmovintarget on Tuesday March 31, 2026 @09:29AM (#47587082)
Parallax arc-second -> distance.

For Star Wars, they retconned it to mean he found the shortest possible route through dangerous space, so even for Han Solo's quote, it's still distance.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by cyrusmg on Tuesday March 31, 2026 @03:09AM (#47583768)
N multiplications of dozen-second