I was trying to figure out why people still use Axios, when the built-in fetch works just fine. Is it because people are still sending XML requests?

I was reading through the thread, and it looks like the package mangers have implemented an option that says "only install package versions that are X minutes/days old". The idea is NPM has had time to act before your package manager installs that new version.

Really sophisticated attack

You can mitigate similar attacks by editing your .npmrc

min-release-age=7 # days
ignore-scripts=true

I always advocate switching to pnpm where install scripts are disabled by default. It has plenty of security features to ward off most supply chain attacks.

• https://pnpm.io/settings#onlybuiltdependencies
• https://pnpm.io/settings#minimumreleaseage
• https://pnpm.io/blog/2025/12/29/pnpm-in-2025#security-by-default

Doesn't seem to have been live for very long.