News for hackers. Stuff that matters.

A comment on Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan. Parent comment

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by thomasmg on Wednesday April 01, 2026 @01:32AM (#47597176)
The point is that you don't need the very latest version. The 20 years old version is enough.
[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by rhdunn on Wednesday April 01, 2026 @02:21AM (#47597498)
XPath 1.0 is a pain to write queries for. XPath 2.0 adds features that make it easier to write queries. XPath 3.1 adds support for maps, arrays, and JSON.

And the default Python XPath support is severely limited, not even a full 1.0 implementation. You can't use the Python XPath support to do things like `element[contains(@attribute, 'value')]` so you need to include an external library to implement XPath.

[ Parent | on HN ]
Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by thomasmg on Friday April 10, 2026 @06:37AM (#47716041)
The problem of XPath 3.1 is that it is very complex [1] - this is a long page. Compared to the 1.0 spec, it is just too complex in my view. For the open source project I'm working on, I never felt that the "old" XPath version is painful.

I think simplicity is better. That's why Json is used nowadays, and XML is not.

[1] https://www.w3.org/TR/xpath-31/ [2] https://jackrabbit.apache.org/oak/docs/query/grammar-xpath.h...

[ Parent | on HN ]