Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by notpushkin on Tuesday March 31, 2026 @03:31AM (#47583918)

TOML has a datetime type (both with or without tz), as well as plain date and plain time:

  start_at = 2026-05-27T07:32:00Z  # RFC 3339
  start_at = 2026-05-27 07:32:00Z  # readable

We should extend it with durations:

  timeout = PT15S  # RFC 3339

And like for datetimes, we should have a readable variant:

  timeout = 15s   # can omit "P" and "T" if not ambiguous, can use lowercase specifiers

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by iririririr on Tuesday March 31, 2026 @10:51AM (#47588211)

great, now attackers can also target all the libraries to enable all that complexity in npm too.

[ Parent | on HN ]