Axios JavaScript library has been compromised with malware in supply chain attack

https://github.com/axios/axios/issues/10604#issuecomment-4159614233

66 points · 5 comments · view on lemmy.world

5 Comments

Armand1@lemmy.world · 10 pts · 148d (2 replies)

I was trying to figure out why people still use Axios, when the built-in fetch works just fine. Is it because people are still sending XML requests?

L_Acacia@lemmy.ml · 10 pts · 148d

It provides a lot of nice syntactic sugar that you would otherwise have to write a wrapper for on top of Fetch. Built in request interception, request transformation, (de)serialization, shared request config, timeout/retries management, ...

Though this definitely comes with bloat and supply chain risks.

TechnoCat@piefed.social · 3 pts · 147d

Because most projects are legacy projects.

moseschrute@crust.piefed.social · 5 pts · 148d

I was reading through the thread, and it looks like the package mangers have implemented an option that says "only install package versions that are X minutes/days old". The idea is NPM has had time to act before your package manager installs that new version.

iByteABit@lemmy.ml · 2 pts · 148d

Really sophisticated attack