Jeff Geerling

Another day, another supply chain attack, this time Axios: https://github.com/axios/axios/issues/10604

Makes me glad I'm lazy and intentional about dependency updates. But it's a worrying trend. Soon we'll be tracking these things by the hour.

[email protected] and [email protected] are compromised · Issue #10604 · axios/axios

more details: https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan Most likely, a maintainer's GitHub and npm accounts are compromised as these iss...

GitHub
Mar 31 at 4:44amWeb
Show threadIan23h ago
@geerlingguy While the Node ecosystem being as popular as it is makes it a big target, it also means these issues have a lot of visibility leading to real change.
Show threadDiane22h ago

@geerlingguy

I'm getting the feeling automation is dangerous, and all our authentication tokens should be on physical hardware that requires human interaction to approve a request.

Show threadThe Orange Theme22h ago
@geerlingguy Who could have foreseen that <script> as a service would go horribly, horribly wrong?
Show threadBenny21h ago
@geerlingguy it's gotten really bad. That's why for a while now I've only been developing in a DevContainer. For my side projects, I'm relying more and more on #Deno, as I hope its security architecture will prevent exactly these kinds of threats.
Show threaddieTasse19h ago
@benny
Went to check whar Deno is... Found https://dbushell.com/2026/03/20/denos-decline-and-layoffs/ looks like it might not ve sort learnig anymore.. 😅
404 Deno CEO not found

The one where I mourn the best runtime and speculate idly

dbushell.com
Show threadBenny19h ago
@dieTasse 😕
Show threadAho21h ago
@geerlingguy soon better just nor use a computer of any kind, it's either loads of backdoor or advertisements
Show threadCsillag Tamás19h ago
@geerlingguy This us business as usual for javascript (npm).
Show threadragectl19h ago
@geerlingguy 300 million downloads for an npm package really is the xkcd Dependency we all love referring to
Show threadBrad Dougherty5h ago
@geerlingguy I never understood why people still used this library after fetch() became available across everything a few years ago.