Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by po1nt on Tuesday March 31, 2026 @05:48AM (#47584901)

That would likely mean same amount of people get the vulnerability, just 7 days later.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by user34283 on Tuesday March 31, 2026 @10:21AM (#47587805)

The compromised packages were removed from the registry within hours.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by brabel on Tuesday March 31, 2026 @12:33PM (#47589916)

Because everyone got updates immediately. If the default was 7 days, almost no one would get updates immediately but after 7 days, and now someone only finds about after 7 days. Unless there is a poor soul checking packages as they are published that can alert the registry before 7 days pass, though I imagine very few do that and hence a dedicated attacker could influence them to not look too hard.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Leherenn on Tuesday March 31, 2026 @12:53PM (#47590210)

If I remember correctly, in all the recent cases it was picked up by automated scanning tools in a few hours, not because someone updated the dependency, checked the code and found the issue.

So it looks like even if no one actually updates, the vast majority of the cases will be caught by automated tools. You just need to give them a bit of time.

[ Parent | on HN ]