人気のHTTPクライアント「Axios」のNode.js実装で、「data:」スキームのURLを与えるだけで無制限にメモリを確保し、 プロセスをクラッシュさせられる脆弱性（CVE-2025-58754）が明らかになりました。 ところがNode用HTTPアダプタは、URLが「data:」で始まる場合にHTTP ...

The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency that delivers a trojan capable of ...

Axios has disclosed two high-severity vulnerabilities in its HTTP/2 implementation that could allow attackers to bypass outbound network controls or crash vulnerable Node.js applications. The flaws ...

The Cybersecurity and Infrastructure Security Agency (CISA) has released an alert to provide guidance in response to the software supply chain compromise of the Axios node package manager (npm). 1 ...

Axios, a hugely popular JavaScript library with 100 million weekly downloads, has been hit by a critical supply chain attack. In a recurring open-source security crisis, developers unknowingly pulled ...

$${{\footnotesize\textbf{・悪性バージョン：axios@1.14.1 / 0.30.4}}}$$ $${{\footnotesize\textbf{・plain-crypto-jsのpostinstallでRAT設置 ...

Every Node.js project accumulates vulnerable dependencies. The npm registry holds over 2.5 million packages, and researchers found 454,000 malicious or vulnerable packages uploaded in 2025 alone.