此次 Axios 供应链攻击事件再次凸显了 npm 生态系统中依赖管理和安全审计的重要性。开发者在快速开发的同时，必须加强对依赖项的审查，使用版本锁定，并禁用不必要的脚本。 每次“一键安装”都可能带来风险，开发者需要时刻保持警惕。 此外，加强对 npm 账号的管理，包括启用双因素认证，也是降低风险的有效措施。这次事件也提醒我们， 供应链安全 已经成为软件开发中不可忽视的关键环节。 随着 npm ...

Attackers stole a long-lived npm access token belonging to the lead maintainer of axios, the most popular HTTP client library in JavaScript, and used it to publish two poisoned versions that install a ...

OpenAI discovered a security breach linked to Axios, a third-party developer tool. The company reassured that user data and ...

OpenAI is rotating potentially exposed macOS code-signing certificates after a GitHub Actions workflow executed a malicious ...