Post Mortem: axios NPM supply chain compromise

Re:Post Mortem: axios NPM supply chain compromise by momo_dev on Friday April 03, 2026 @03:07AM (#47624006)

this is why i pin every dependency hash in my python projects. pip install --require-hashes with a locked requirements file catches exactly this, if the package hash changes unexpectedly the install fails. surprised this isn't the default in the npm ecosystem

[ Parent | on HN ]

Re:Post Mortem: axios NPM supply chain compromise by minitech on Friday April 03, 2026 @03:57AM (#47624222)

Npm and the other JavaScript package managers do generate and check lockfiles with hashes by default. This was a new release, not a republishing of an old version (which isn’t possible on the npm registry anyway).

[ Parent | on HN ]

Re:Post Mortem: axios NPM supply chain compromise by momo_dev on Friday April 03, 2026 @04:49PM (#47632074)

i wasn't aware npm lockfiles check hashes by default now. my concern is more about the initial install before a lockfile exists, like in CI from a fresh clone without a committed lockfile. but you're right, once the lockfile is there the hash mismatch would be caught.

[ Parent | on HN ]