Concerns that even removing axios directly still pulls it as a transitive dependency from major vendors like Datadog, Slack, and Twilio
← Back to Axios compromised on NPM – Malicious versions drop remote access trojan
The persistence of Axios as a transitive dependency underscores a systemic fragility in the modern software ecosystem, where even diligent developers find it nearly impossible to purge vulnerable code buried within major vendor packages like Datadog or Slack. While some critics view the npm model as a "failed experiment" and a "house of cards," others contrast its fragmented nature with the "batteries-included" stability of .NET or the single-file simplicity of classic C libraries. This deep-rooted dependency bloat creates a digital "minefield," where the sheer scale of Axios’s 175,000 dependents ensures that supply chain attacks remain a ubiquitous threat regardless of whether a developer has migrated to native alternatives like `fetch`. Ultimately, the conversation reflects a growing sense of security nihilism, suggesting that no matter how much you pin versions or audit direct imports, you are likely still one sub-dependency away from being compromised.
28 comments tagged with this topic