Post #1630540
2026-03-31 06:30 UTC
Axios has been hacked...
https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
#security #javascript #frontend
Replies (1)
-
@stevel@hachyderm.io 2026-03-31 08:41
@xgebi@hachyderm.io dependabot lets you set a minimum age of a dependency before a PR is raised, something like 7+ days old apparently protects against these attacks affecting you -by then it's already surfaced and the malware blocker will be at work. Key: never be in a rush to update your NPM dependencies. If you must use NPM #cybersecurity