Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by invaliduser on Tuesday March 31, 2026 @07:05AM (#47585583)

For a lot of code, I switched to generating code rather than using 3rd party libraries. Things like PEG parsers, path finding algorithms, string sanitizers, data type conversion, etc are very conveniently generated by LLMs. It's fast, reduces dependencies, and feels safer to me.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by troad on Tuesday March 31, 2026 @07:08AM (#47585612)

Ah, so you've traded the possibility of bad dependencies for certainty.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by raddan on Tuesday March 31, 2026 @08:14AM (#47586200)

Remember, our objective function here is “feels safe.”

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by invaliduser on Tuesday March 31, 2026 @08:35AM (#47586439)

How can you come to that conclusion, given the specific examples I have given, which are tedious to write, but easy to proof-read and test?

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by senordevnyc on Tuesday March 31, 2026 @10:18AM (#47587775)

Because AI threatens the identity of many programmers.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by troad on Tuesday March 31, 2026 @09:42PM (#47595750)

Lol. My most recent comment before this one is here: https://news.ycombinator.com/item?id=47583593. You judge if AI threatens my identity. But hey, don't let the facts get in the way of a slick narrative.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by tzs on Tuesday March 31, 2026 @08:40AM (#47586485)

Or find the best third party library and copy the code from a widely used version that has been out long enough to have been well tested into your source tree.

The problem is not third party libraries. It is updating third party libraries when the version you have still works fine for your needs.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by estebank on Tuesday March 31, 2026 @10:48AM (#47588168)

Don't do this. Use a package manager that let's you specify a specific version to pin against. Vendoring side steps most automated tooling that can warn you about vulnerabilities. Vendoring is a signal that your tooling is insufficient, 99% of the time.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by gjadi on Tuesday March 31, 2026 @01:01PM (#47590318)

Vendoring means you don't have to fetch the internet for every build, that you can work offline, that you're not at the mercy of the oh-so-close-99.999 availability, that it will keep on working in 10 years, and probably other advantages.

If your tooling can pull a dependency from the internet, it could certainly check if more recent version from a vendored one is available.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by estebank on Tuesday March 31, 2026 @01:58PM (#47591162)

Is there any package manager incapable of working offline?

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by lelanthran on Tuesday March 31, 2026 @04:29PM (#47593041)

> Is there any package manager incapable of working offline?

I think you've identified the problem here: package management and package distribution are two different problems. Both tools have possibilities for exploits, but if they are separate tools then the surface area is smaller.

I'm thinking that the package distribution tool maintains a local system cache of packages, using keys/webrings/whatever to verify provenance, while the package management tool allows pinning, minver/maxver, etc.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by everforward on Tuesday March 31, 2026 @07:47PM (#47594978)

This is only true if you aren’t internally mirroring those packages.

Most places I’ve worked have Artifactory or something like it sitting between you and actual PyPI/npm/etc. As long as someone has pulled that version at some point before the internet goes out, it’ll continue to work after.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by kjok on Tuesday March 31, 2026 @11:31PM (#47596482)

And this is exactly why we see noise on HN/Reddit when a supply-chain cyberattack breaks out, but no breach is ever reported. Enterprises are protected by internal mirroring.

[ Parent | on HN ]