Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by Groxx on Wednesday April 01, 2026 @10:00AM (#47601002)

Third party libraries have been avoiding those json footguns (and significantly improving performance) for well over a decade before stdlib got it. Same with logging. And it's looking like it will be over two decades for an even slightly reasonable http client.

Stuff outside stdlib can, and almost always does, improve at an incomparably faster rate.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by lokar on Wednesday April 01, 2026 @11:21AM (#47602106)

And I think the Go people seem to do a fairly good job of picking out the best and most universal ideas from these outside efforts and folding them in.

[ Parent | on HN ]

Re:Axios Compromised on NPM – Malicious Versions Drop Remote... by hu3 on Wednesday April 01, 2026 @06:19PM (#47607267)

.NET's JSON and their Kestrel HTTP server beg to differ.

Their JSON even does cross-platform SIMD and their Kestrel stack was top 10/20 on techempower benchmarks for a while without the ugly hacks other frameworks/libs use to get there.

stdlib is the science of good enough and sometimes it's far above good enough.

[ Parent | on HN ]