c/programming · by spez@sh.itjust.works · 152d

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html

What an ol' classic in the age of AI!

59 points · 3 comments · view on lemmy.world

3 Comments

It gets better and better lol

I always advocate switching to pnpm where install scripts are disabled by default. It has plenty of security features to ward off most supply chain attacks.

https://pnpm.io/settings#onlybuiltdependencies
https://pnpm.io/settings#minimumreleaseage
https://pnpm.io/blog/2025/12/29/pnpm-in-2025#security-by-default

onlinepersona@programming.dev · 7 pts · 152d

Pre and post install hooks are a mistake, jfk

ultimate_worrier@lemmy.dbzer0.com · -1 pts · 152d

[ removed ]