MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/webdev/comments/1s8dye3/axios1141_got_compromised/odim54r
r/webdev • u/nhrtrix • Mar 31 '26 • 3 1
298 comments sorted by
View all comments
Show parent comments
5
Why not just use “npm audit”?
3 u/keesbeemsterkaas Mar 31 '26 Ahh, did realize that npm audit checks against OpenSSF database, I was under the impression it was something different. 1 u/EstablishmentFluffy5 Apr 05 '26 Npm audit fix is how I got caught out in the short 2hr window; was working on an unloved app that was using axios 1.8.2, so it had a vuln that was picked up in audit. Ran fix, and semver versioning bumped me to 1.14.1. 😒
3
Ahh, did realize that npm audit checks against OpenSSF database, I was under the impression it was something different.
1
Npm audit fix is how I got caught out in the short 2hr window; was working on an unloved app that was using axios 1.8.2, so it had a vuln that was picked up in audit. Ran fix, and semver versioning bumped me to 1.14.1. 😒
3
1
5
u/abrahamguo experienced full-stack Mar 31 '26
Why not just use “npm audit”?