Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by zachrip on Tuesday March 31, 2026 @10:57AM (#47588281)

Fetch has also lacked support for features that xhr has had for over a decade now. For example upload progress. It's slowly catching up though, upload progress is the only thing I'd choose xhr for.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by apitman on Tuesday March 31, 2026 @04:26PM (#47593003)

You can pipe through a TransformStream that counts how many bytes you've uploaded, right?

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by zachrip on Tuesday March 31, 2026 @05:39PM (#47593823)

That is a way to approximate it, though I'd be curious to know the semantics compared to xhr - would they both show the same value at the same network lifecycle of a given byte?

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by afavour on Wednesday April 01, 2026 @07:09AM (#47599311)

That would show how quickly the data is passing into the native fetch call but doesn’t account for kind of internal buffer it might have, network latency etc

[ Parent | on HN ]