Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Levitating on Tuesday March 31, 2026 @05:27AM (#47584774)

Or just lock to a specific version?

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by silverwind on Tuesday March 31, 2026 @07:49AM (#47585987)

Eventually you will want to update it, every update is a risk.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by SkyPuncher on Tuesday March 31, 2026 @09:39AM (#47587229)

But, pinning has prevented most of the recent supply chain attacks.

As long as you don't update your pins during an active supply chain attack, the risk surface is rather low.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by habinero on Tuesday March 31, 2026 @05:16PM (#47593572)

The flip side of that is now you're running old software and CVEs get published all the time. Threat actors actively scan the internet looking for software that's vulnerable to new CVEs.

[ Parent | on HN ]