Ron Northcutt rlnorthcutt

On March 31, 2026, a supply chain compromise was identified in the Axios library. Versions 1.14.1 and 0.30.4 were found to include a malicious dependency, plain-crypto-js, which executes a Remote Access Trojan (RAT) upon installation.

🔍 Detection Command

Run the following command from your root projects directory to scan all local repositories. This search prioritizes the "smoking gun" dependency (plain-crypto-js) and the compromised version numbers across all major lockfile formats.

grep -rE "plain-crypto-js|axios.*(1\.14\.1|0\.30\.4)" . \
 --include="*-lock.json" \

	# --- FRONTEND CONFIGURATION ---
	frontend ft_horizon_tcp_blast
	# Blast protocol is tunneled on UAGs, running on port 8443 (external) vs. internal.
	bind *:8443
	default_backend bk_horizon_tcp_blast

	# --- BACKEND CONFIGURATION ---
	# 1. Dedicated Health Check Backend (The Source of Truth)
	backend be_uag_https
	mode http

	#------------ Global and defaults ------------#
	# Set performance tuning and security logging
	# [Placeholder: Global/defaults for buffer sizes, timeouts]

	#----- Frontend: accept and route traffic -----#
	frontend main_ingress
	bind :443 ssl crt /etc/haproxy/certs/
	mode http

	# Apply security policies at the edge

	frontend www
	...
	# ensure buffer request is enabled
	option http-buffer-request

	# acls to detect react CVE
	acl is_form_content req.hdr(Content-Type) -m sub multipart/form-data or req.hdr(Content-Type) -m sub application/x-www-form-urlencoded
	acl header_has_cve_2025_55182 req.hdr(next-action) -m found or req.hdr(rsc-action-id) -m found
	acl body_has_cve_2025_55182 req.body -m sub -i constructor prototype __proto__ _response:

	# /etc/haproxy/haproxy.cfg

	global
	log stdout format raw local0

	defaults
	mode http
	timeout client 50000
	timeout server 50000
	timeout connect 5000

	<?php

	declare(strict_types=1);

	use Drupal\Core\Entity\EntityInterface;
	use Drupal\comment\CommentInterface;

	/**
	* Implements hook_ENTITY_TYPE_insert().
	*

	# Match both POST and PUT methods that could be used for uploads
	acl is_upload method POST PUT
	acl is_sap_uploader path -m beg /developmentserver/metadatauploader


	# Block the requests
	http-request deny deny_status 403 if is_upload is_sap_uploader
	Add this configuration to your HAProxy frontend section that handles SAP NetWeaver traffic.

	// What is this file?
	// This file is for use with the SmallWeb project, which is a lightweight web server
	// and framework for building web applications. The purpose of this file is to
	// define the development environment for a SmallWeb dev instance using
	// Visual Studio Code's Remote - Containers feature.

	// It specifies the configuration for the development container, including the base image,
	// features, environment variables, and post-creation commands.Think of it as a recipe for
	// creating a consistent and isolated development environment.

	<?xml version="1.0" encoding="UTF-8"?>
	<urlset
	xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.sitemaps.org/schemas/sitemap/0.9
	http://www.sitemaps.org/schemas/sitemap/0.9/sitemap.xsd">


	<url>
	<loc>https://pocketbase.io/</loc>

	backend bk_horizon_tcp_blast
	balance source
	hash-type consistent sdbm
	hash-key addr-port
	hash-balance-factor 150
	# Still tracking our central health backend server srv1
	192.168.1.101:22443 track be_uag_health/srv1 server srv2
	192.168.1.102:22443 track be_uag_health/srv2