npm/@lightdash/cli: critical 9.6
Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions
Action: Upgrade @lightdash/cli to 0.2695.1 or later.
npm i @lightdash/cli@0.2695.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.1800.0 | 0.2695.1 | - |
Fixed versions
| 0.2695.1 |
Sources
- osv: GHSA-3hfp-gqgh-xc5g
- https://github.com/lightdash/lightdash/security/advisories/GHSA-3hfp-gqgh-xc5g
- https://github.com/axios/axios/issues/10604
- https://github.com/advisories/GHSA-fw8c-xr5c-95f9
- https://github.com/lightdash/lightdash
- https://security.snyk.io/vuln/SNYK-JS-AXIOS-15850650
- https://security.snyk.io/vuln/SNYK-JS-PLAINCRYPTOJS-15850652
- https://socket.dev/blog/axios-npm-package-compromised
- https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html
- https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
published · modified · JSON