Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by woodruffw on Tuesday March 31, 2026 @08:47AM (#47586583)

It should work for global configuration too, please file an issue if you’re observing otherwise.

(Make sure you’re on a version that actually supports relative times, please!)

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by sbarre on Tuesday March 31, 2026 @09:07AM (#47586810)

This is what tripped me up. I added that config and then got this error:

error: Failed to parse: `.config/uv/uv.toml` Caused by: TOML parse error at line 1, column 17 | 1 | exclude-newer = "7 days" | ^^^^^^^^ failed to parse year in date "7 days": failed to parse "7 da" as year (a four digit integer): invalid digit, expected 0-9 but got

I was on version 0.7.20, so I removed that line, ran "uv self update" and upgraded to 0.11.2 and then re-added the config and it works fine now.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by woodruffw on Tuesday March 31, 2026 @09:11AM (#47586870)

Yeah, that error message isn’t ideal on older versions, but unfortunately there’s no way to really address that. But I’m glad it’s working for you on newer versions.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by sbarre on Tuesday March 31, 2026 @01:14PM (#47590502)

For what it's worth the error made sense enough to me that I figured I needed to upgrade. :-)

[ Parent | on HN ]