This might be of interest: https://docs.npmjs.com/cli/v11/commands/npm-install/#before and https://docs.npmjs.com/cli/v11/commands/npm-install/#min-release-age See also the equivalents: pip: https://pip.pypa.io/en/stable/cli/pip_install/#cmdoption-uploaded-prior-to uv: https://docs.astral.sh/uv/reference/settings/#exclude-newer Also, HN thread: https://news.ycombinator.com/item?id=47582220

Hello @calm-artist-7206, Thank you for sharing this thread! Current status: We are safe. Our package-lock.json already pins Axios at version 1.13.5 with a verified integrity hash, and npm ci (used in CI) strictly respects the lockfile. However, the previous ^1.13.5 specifier allowed developers running npm install or npm update to potentially resolve to 1.14.1 and unintentionally update the lockfile. Pinning the exact version removes this risk. To address this, I have created a pull request to pin the Axios version explicitly: fix(frontend): pin axios version to mitigate supply chain attack Thank you very much! thankyou