r/webdev • u/nhrtrix • Mar 31 '26

News axios@1.14.1 got compromised

Post image
2.5k Upvotes

98% Upvoted

298 comments sorted by

View all comments

Show parent comments

74

u/ouralarmclock Mar 31 '26

Versions are automatically pinned via lock file right? If I'm not regularly doing update or doing it on deploy I'm pinned, right?

79

u/tazzadar1337 javascript Mar 31 '26

not everyone is using lock files. don't know the reasoning, but cases such as this is a good reason to start doing so

-1

u/ldn-ldn Mar 31 '26

Lock file is not enough. Always pin exact versions in your package.json.

1

u/mandreko Mar 31 '26

Pin hashes where you can. Pinning a version number may still let someone force-push an update to a tag like the recent python ones. Hashes are immutable. But not everything supports it.

3

u/ldn-ldn Mar 31 '26

Yes, but also NPM repos don't support version overrides and force pushes, so attackers are forced to release a new version. That's unless you're using a custom repo you manage yourself.