News for hackers. Stuff that matters.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by friendzis on Tuesday March 31, 2026 @03:31AM (#47583916)
Workdays! Think about it, if you set the delay in regular days/seconds the updated dependency can get pulled in on a weekend with only someone maybe on-call.

(Hope your timezones and tzdata correctly identifies Easter bank holiday as non-workdays)

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by yohannesk on Tuesday March 31, 2026 @04:07AM (#47584134)
And we also need localization. Each country can have their own holidays
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by rolandog on Tuesday March 31, 2026 @04:35AM (#47584345)
And we need groups of locales for teams that are split across multiple locations; e.g.:

  new_date = add_workdays(
    workdays=1.5,
    start=datetime.now(),
    regions=["es", "mx", "nl", "us"],
  )
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by mewpmewp2 on Tuesday March 31, 2026 @04:59AM (#47584525)
Hopefully "es" will have Siesta support too.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by zdc1 on Tuesday March 31, 2026 @04:51AM (#47584469)
Might be better to calculate them separately for each locale and then tie-break with your own approach (min/max/avg/median/etc.)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by wongarsu on Tuesday March 31, 2026 @06:30AM (#47585263)
Don't forget about regional holidays, which might follow arbitrary borders that don't match any of the official subdivisions of the country. Or may even depend on the chosen faith of the worker
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by reaperducer on Tuesday March 31, 2026 @09:01AM (#47586754)
Pulaski day in Illinois. Or Reds Opening Day in Cincinnati.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday March 31, 2026 @04:24AM (#47584263)
> Workdays!

This is javascript, not Java.

In JavaScript something entirely new would be invented, to solve a problem that has long been solved and is documented in 20+ year old books on common design patterns. So we can all copy-paste `{ or: [{ days: 42, months: 2, hours: "DEFAULT", minutes: "IGNORE", seconds: null, timezone: "defer-by-ip" }, { timestamp: 17749453211*1000, unit: "ms"}]` without any clue as to what we are defining.

In Java, a 6000LoC+ ecosystem of classes, abstractions, dependency-injectables and probably a new DSL would be invented so we can all say "over 4 Malaysian workdays"

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by mikeryan on Tuesday March 31, 2026 @08:13AM (#47586191)
JavaScript Temporal. Not sure knowing what a "workday" is in each timezone is in it's scope but it's the much needed and improved JS, date API (granted with limited support to date)

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by whatisthiseven on Tuesday March 31, 2026 @04:41AM (#47584388)
But you know that Java solution will continue working even after we no longer use the Gregorian Calendar, the collapse and annexation of Malaysia to some foreign power, and then us finally switching to a 4-day work week; so it'd be worth it.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by nesarkvechnep on Tuesday March 31, 2026 @05:18AM (#47584698)
It probably won’t work correctly from the get go. But it can be debugged everywhere so that’s good.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday March 31, 2026 @06:29AM (#47585245)
... and since it was architectured to allow runtime injection-patching of events before they hit the enterprise-service-bus, everyone using this library must first set fourteen ENV vars in their profile, and provide a /etc/java/springtime/enterprise-workday-handling/parse-event-mismatch.jar.patch. Which should fix the bug for you.

You can find the patch files for your OSs by registering at Oracle with a J3EE8.4-PatchLibID (note, the older J3EE16-PatchLib-ids aren't compatible), attainable from your regional Oracle account-manager.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by hluska on Tuesday March 31, 2026 @08:54AM (#47586666)
This isn’t even remotely funny.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by pcblues on Tuesday March 31, 2026 @11:19AM (#47588645)
I am laughing. I'm not even near the end of this thread.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by xorcist on Tuesday March 31, 2026 @09:54AM (#47587437)
And least one of those environment can contain template strings that are expanded with arguments from request headers when run under popular enterprise java frameworks, and by way of the injection patching could hot load arbitrary code in runtime.

A joke should be funny though, not just a dry description of real life, so let's leave it at that. We've already taken it too far.

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by PunchyHamster on Tuesday March 31, 2026 @08:23AM (#47586292)
In before someone thinks it's a joke, the most commonly used logging library in Java had LDAP support in format scripts enabled by default" (which resulted, of course in CVE)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by myhf on Tuesday March 31, 2026 @12:19PM (#47589697)
There's an extra digit in your timestamp.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday April 07, 2026 @03:06PM (#47679900)
Ah but you don't know how far in the future I intended it to be :)
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by sverhagen on Tuesday March 31, 2026 @08:15AM (#47586212)
Why would it get pulled in over the weekend? What automatic deployments are you running if there also isn't a human working to get it out?

Do you run automatic dependency updates over the weekend? Wouldn't you rather do that during fully-staffed hours?

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by ecshafer on Tuesday March 31, 2026 @09:43AM (#47587302)
When I worked in Finance our internal Date extension did actually have Workdays that took into account Stock Market and Bank Holidays.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by tsukikage on Tuesday March 31, 2026 @11:07AM (#47588457)
…now imagine a list of instruments, some of which have durations specified in days/weeks/months (problems already with the latter) and some in workdays, and the user just told your app to display it sorted by duration.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by brunoarueira on Tuesday March 31, 2026 @11:31AM (#47588858)
Me too, it was just a constant filled with bank holidays for the next 6 years
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by matltc on Tuesday March 31, 2026 @11:12AM (#47588532)
I tried to write this function in Power Query (Excel hell). Gave up after an hour or so.
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by dspillett on Tuesday March 31, 2026 @10:07AM (#47587618)
Nah, working hours and make global assumptions of 0900-1230/1330-1730, M-F, and have an overly convoluted way to specify what working ours actually are in the relevant location(s).