News for hackers. Stuff that matters.

A comment on Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan. Parent comment

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by victorbjorklund on Tuesday March 31, 2026 @05:25AM (#47584758)
I think you can do copy paste in most languages. But it will be a pain to update when there are improvements / security fixes.

You got a project with 1-2 depencies? Sure. But if you need to bring in 100 different libs (because you bring in 10 libs which in turn brings in 10 libs) good luck.

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by skydhash on Tuesday March 31, 2026 @07:38AM (#47585862)
> But if you need to bring in 100 different libs (because you bring in 10 libs which in turn brings in 10 libs

So don’t?

With manual deps management, everyone soon gravitates to a core set of deps. And libraries developer tends to reduce their deps needs, That’s why you see most C libraries deals with file formats, protocols, and broad concerns. Smaller algorithms can be shared with gists and blog articles.

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by habinero on Tuesday March 31, 2026 @12:55PM (#47590239)
> Smaller algorithms can be shared with gists and blog articles

You just invented a worse Stack Overflow.

Using libraries is good, actually.

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by skydhash on Tuesday March 31, 2026 @03:43PM (#47592421)
Like is-even or leftpad?
[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by habinero on Tuesday March 31, 2026 @04:58PM (#47593397)
Like requests and pytest and ruff and so on, yes.

Rewriting the world to protect against a specific kind of threat is insane.

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by skydhash on Tuesday March 31, 2026 @09:18PM (#47595619)
It's not there isn't good libraries everywhere. It just the practice around NPM that people are appalled with. It's all about lowering the barrier for developers, even in spite of security and quality.
[ Parent | on HN ]