Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by berkes on Tuesday March 31, 2026 @06:29AM (#47585245)

... and since it was architectured to allow runtime injection-patching of events before they hit the enterprise-service-bus, everyone using this library must first set fourteen ENV vars in their profile, and provide a /etc/java/springtime/enterprise-workday-handling/parse-event-mismatch.jar.patch. Which should fix the bug for you.

You can find the patch files for your OSs by registering at Oracle with a J3EE8.4-PatchLibID (note, the older J3EE16-PatchLib-ids aren't compatible), attainable from your regional Oracle account-manager.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by hluska on Tuesday March 31, 2026 @08:54AM (#47586666)

This isn’t even remotely funny.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by pcblues on Tuesday March 31, 2026 @11:19AM (#47588645)

I am laughing. I'm not even near the end of this thread.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by xorcist on Tuesday March 31, 2026 @09:54AM (#47587437)

And least one of those environment can contain template strings that are expanded with arguments from request headers when run under popular enterprise java frameworks, and by way of the injection patching could hot load arbitrary code in runtime.

A joke should be funny though, not just a dry description of real life, so let's leave it at that. We've already taken it too far.

[ Parent | on HN ]