215
Axios JavaScript library has been compromised with malware in supply chain attack (github.com)
submitted 7 months ago by to c/selfhosted@lemmy.world
12 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 33 points 7 months ago* (5 children)

You can mitigate similar attacks by editing your .npmrc

min-release-age=7 # days
ignore-scripts=true
  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 38 points 7 months ago (4 children)

    It's a good way to keep the exploit around for seven days, too, if you apply it right away.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 8 points 7 months ago (2 children)

    I agree, I think it would be better to use something like dependabot or renovatebot so you can know of and apply security updates right away.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 7 months ago

    How? If you got hit by this you are looking at restoring the system from a safe previous version.

    And the compromised versions get pulled, not superseeded by a new release, so once you rebuild you would go back to a safe version...

  • permalink
  • fedilink
  • source
  • parent