From bec36fc99f00653487798844801861378bf511d8 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Sun, 5 Apr 2026 18:40:24 +0200 Subject: [PATCH] security: pin axios to 1.14.0 to prevent supply chain attack Axios versions 1.14.1 and 0.30.4 were compromised on March 31, 2026 with a RAT dropper (plain-crypto-js) attributed to North Korean threat actor UNC1069/Sapphire Sleet. The malicious versions have been removed from npm but our ^1.12.2 range could have pulled 1.14.1 on next install. Pin to exact version 1.14.0 (latest safe release) in both frontend and backend package.json and lock files to prevent any future resolution to compromised versions. References: - https://github.com/axios/axios/issues/10604 - https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/ --- backend/package-lock.json | 25 ++++++++++++++----------- backend/package.json | 2 +- frontend/package-lock.json | 25 ++++++++++++++----------- frontend/package.json | 2 +- 4 files changed, 30 insertions(+), 24 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index 25164eac..583e405f 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -1,12 +1,12 @@ { "name": "picpeak-backend", - "version": "3.18.0-beta.0", + "version": "3.24.0-beta.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "picpeak-backend", - "version": "3.18.0-beta.0", + "version": "3.24.0-beta.0", "dependencies": { "@aws-sdk/client-s3": "^3.850.0", "@aws-sdk/lib-storage": "^3.850.0", @@ -14,7 +14,7 @@ "@ffmpeg-installer/ffmpeg": "^1.1.0", "adm-zip": "^0.5.16", "archiver": "^5.3.1", - "axios": "^1.12.2", + "axios": "1.14.0", "bcrypt": "6.0.0", "chokidar": "4.0.3", "cookie-parser": "^1.4.7", @@ -4071,14 +4071,14 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.13.6", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz", - "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==", + "version": "1.14.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.14.0.tgz", + "integrity": "sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==", "license": "MIT", "dependencies": { "follow-redirects": "^1.15.11", "form-data": "^4.0.5", - "proxy-from-env": "^1.1.0" + "proxy-from-env": "^2.1.0" } }, "node_modules/babel-jest": { @@ -9592,10 +9592,13 @@ } }, "node_modules/proxy-from-env": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz", - "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==", - "license": "MIT" + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz", + "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==", + "license": "MIT", + "engines": { + "node": ">=10" + } }, "node_modules/pstree.remy": { "version": "1.1.8", diff --git a/backend/package.json b/backend/package.json index 6cd468af..05194440 100644 --- a/backend/package.json +++ b/backend/package.json @@ -19,7 +19,7 @@ "@ffmpeg-installer/ffmpeg": "^1.1.0", "adm-zip": "^0.5.16", "archiver": "^5.3.1", - "axios": "^1.12.2", + "axios": "1.14.0", "bcrypt": "6.0.0", "chokidar": "4.0.3", "cookie-parser": "^1.4.7", diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 63fdbb68..e32da250 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "picpeak-frontend", - "version": "2.5.0", + "version": "3.24.0-beta.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "picpeak-frontend", - "version": "2.5.0", + "version": "3.24.0-beta.0", "dependencies": { "@tanstack/react-query": "^5.0.0", "@tiptap/extension-character-count": "^2.26.1", @@ -20,7 +20,7 @@ "@types/dompurify": "^3.0.5", "@types/lodash": "^4.17.20", "@types/react-google-recaptcha": "^2.1.9", - "axios": "^1.12.2", + "axios": "1.14.0", "clsx": "^2.0.0", "date-fns": "4.1.0", "dompurify": "^3.2.6", @@ -3020,14 +3020,14 @@ } }, "node_modules/axios": { - "version": "1.13.6", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz", - "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==", + "version": "1.14.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.14.0.tgz", + "integrity": "sha512-3Y8yrqLSwjuzpXuZ0oIYZ/XGgLwUIBU3uLvbcpb0pidD9ctpShJd43KSlEEkVQg6DS0G9NKyzOvBfUtDKEyHvQ==", "license": "MIT", "dependencies": { "follow-redirects": "^1.15.11", "form-data": "^4.0.5", - "proxy-from-env": "^1.1.0" + "proxy-from-env": "^2.1.0" } }, "node_modules/balanced-match": { @@ -5751,10 +5751,13 @@ } }, "node_modules/proxy-from-env": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz", - "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==", - "license": "MIT" + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz", + "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==", + "license": "MIT", + "engines": { + "node": ">=10" + } }, "node_modules/punycode": { "version": "2.3.1", diff --git a/frontend/package.json b/frontend/package.json index 858012f7..afb15c5a 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -24,7 +24,7 @@ "@types/dompurify": "^3.0.5", "@types/lodash": "^4.17.20", "@types/react-google-recaptcha": "^2.1.9", - "axios": "^1.12.2", + "axios": "1.14.0", "clsx": "^2.0.0", "date-fns": "4.1.0", "dompurify": "^3.2.6",