Anyone who allowed this to hit production should take a serious look at their testing process. This basically looks like axios's get method, which is probably a

Anyone who allowed this to hit production should take a serious look at their testing process. This basically looks like axios's get method, which is probably a core use of the library, simply went missing. This should not have been a difficult issue for the most basic automated testing library or manual testing process to identify. That being said, the ultimate culprit here is the nodeJS system. npm install will add the package with it being setup to upgrade to the latest minor version by default, instead of the obvious choice of fixing it to the specific version that was installed. Further, the package-lock.json technology is neither well explained by NodeJS, nor well documented. The process one should use is not well explained either. And often fairly trivial changes will lead to significant changes in package-lock.json.