Security: Compromised NPM package (Axios) [Indico is NOT affected]

Administrators
1

Hello,

The package “axios” is compromised and this creates a very serious vulnerability. Compromised versions are v1.14.1 and v.0.30.4. More details in this issue: axios@1.14.1 and axios@0.30.4 are compromised · Issue #10604 · axios/axios · GitHub

Since Indico is using axios and the version is not upper-bounded in package.json, I wonder if this has any affect that should be considered, and should there be a emergency-release that bounds the version to a version earlier than v1.14.1.

I don’t know the details of how npm behaves when it selects versions to be fair, so this may not be an issue but wanted to raise this asap.

2

Indico is not affected. We use a lockfile, and the locked version is far older than the compromised one. There is also no JS build/installation of any kind happening when installing indico, this is all done at build (release) time.

PS: The compromised packages have already been wiped from npm. So even if Indico was installing the latest version (which it isn’t), then the risky period for this particular incident would have been over already.

1 Like
3

Thanks, I was just checking how the build is done and saw that as well. Glad it’s not affected.

Many thanks!