Rewards Hub The popular npm package axios has been compromised in a supply chain attack, with version 1.14.1 containing malicious code. Yu Xian, founder of SlowMist, relayed a warning from Feross, founder of Socket AI, highlighting that the package has been injected with the malware plain-crypto-js@4.2.1. This development poses a significant risk to projects using axios, which sees over 100 million weekly downloads.
Socket AI's analysis confirmed the presence of the malware, prompting Feross to advise developers to pin their axios versions and review lock files to prevent potential security breaches. Users are urged to avoid upgrading to the affected version to mitigate risks.
Axios npm Package Compromised in Supply Chain Attack
Aviso legal: El contenido de Phemex News es únicamente informativo.No garantizamos la calidad, precisión ni integridad de la información procedente de artículos de terceros.El contenido de esta página no constituye asesoramiento financiero ni de inversión.Le recomendamos encarecidamente que realice su propia investigación y consulte con un asesor financiero cualificado antes de tomar cualquier decisión de inversión.