https://x.com/feross/status/2038807290422370479 Supply chain attack on axios which is used by flyteconsole.

Just pining a safe version won’t work. What if there is another package which uses axios internally. All those packages have to be pinned as well. I cannot find

axios

package in package.json file. https://github.com/flyteorg/flyteconsole/blob/master/package.json Where in flyteconsole is it used @nice-hairdresser-45030

Hmm,

Axios

is not a direct dependency for flyteconsole but is imported by other packages. Check it out here and pin it. https://github.com/flyteorg/flyteconsole/blob/2e69321d94292051fbb1762fc871d0abf0b3d398/yarn.lock Currently the compromized version is removed but, the maintainer credentials are compromized, so if possible remove

axios

all together or add a substitute This smells exactly like LiteLLM hack a few weeks back

Hey @nice-hairdresser-45030 / @acceptable-knife-37130 thank you for bubbling this up. I am looking into removing axios in favor of plain fetch. We’ll try to get a new release out ASAP