3 ms·

Ok it's bad, but our npm projects are pinned in the package-lock.json, which I imagine most would be? So who would pull this besides security scanners?

• croemer 7mo ago
  `npm install` might be enough to pull it, unless you pin down to the patch?
  • flerchin 7mo ago
    I don't think that's right if it's in your package-lock it wouldn't pull it unless you npm update axios, or delete the package-lock.json and then npm install.