Axios JavaScript library has been compromised with malware in supply chain attack
https://github.com/axios/axios/issues/10604#issuecomment-4159614233Open linkView original on lemmy.worldSyndicated from the fediverse. Read and engage on the original instance.
View original on lemmy.worldhttps://github.com/axios/axios/issues/10604#issuecomment-4159614233Open linkView original on lemmy.world
5 replies
I was trying to figure out why people still use Axios, when the built-in
fetchworks just fine. Is it because people are still sending XML requests?It provides a lot of nice syntactic sugar that you would otherwise have to write a wrapper for on top of Fetch. Built in request interception, request transformation, (de)serialization, shared request config, timeout/retries management, ...
Though this definitely comes with bloat and supply chain risks.
Because most projects are legacy projects.
I was reading through the thread, and it looks like the package mangers have implemented an option that says "only install package versions that are X minutes/days old". The idea is NPM has had time to act before your package manager installs that new version.
Really sophisticated attack