This is the forum of the developer community of Apify. 

Find answers to pre-existing questions about Crawlee, Apify, and our other open-source projects here.

Apify

thanks we are sending email to the affected devs.

Have you detected something on your end? (Wondering how you can identify devs that have actors using the affected version or is it just as a precaution?)

we are asking devs to delete the build which are built using those specific versions of axios.

In addition to that they should pin to known safe versions and **rotate what could/should be rotated** - the ones that might be impacted are those who ran builds/installs between 00:21 UTC -> 03:15 UTC

These types of attacks became frequent https://discord.com/channels/801163717915574323/1206131794261315594/1418541360364912671 (there were two around of last year)

To prevent, one quick tip for individual devs is -when possible- to use  --ignore-scripts when doing nom install or add it to .npmrc or/and wait for some period and not rush to install updates as soon as they are published (so community would surface issues + automated scan tools do their scans)

But for companies I believe the best policy is to use a custom npm registry -this is what we do- (where packages updates are added after manual approval + waiting for a few days)