Axios
Ranked 2 of 11 HTTP client libraries by recommenders
Developers recommend it for easier error handling, interceptors and JSON parsing than raw fetch. Main caveat: critics point to malicious npm releases and say native fetch covers much of it.
Developers recommend it for easier error handling, interceptors and JSON parsing than raw fetch. Main caveat: critics point to malicious npm releases and say native fetch covers much of it.
58 people gave an opinion
- recommend it
- 21
- criticize it
- 37
- approval share
- 36%
Recommended in 5 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 21 people recommend itNeeds 10 or more, met.
- 0.5 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Handles errors, interceptors and JSON parsing
“Because your fetch most likely mishandle errors, lack retries, fail on redirects and is unnecessary verbose for both people and agents.”
Comment from 23 Apr 2026 in “OpenAI's response to the Axios developer tool compromise” “Also it has interceptors, which allow you to build easily reusable pieces of code”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” “Axios handles errors better, has interceptors, parses JSON for you”
Comment from 4 Apr 2026 in “Post Mortem: axios NPM supply chain compromise” - Comment from 23 Apr 2026 in “OpenAI's response to the Axios developer tool compromise”
Avoids reinventing HTTP client features
“Every team I've seen write a fetch wrapper eventually reimplements half of axios, just worse.”
Comment from 2 Apr 2026 in “Replace axios with a simple custom fetch wrapper” “Axios is something where you get most of that work done for you by the community for free”
Comment from 23 Apr 2026 in “OpenAI's response to the Axios developer tool compromise” “Axios and other libraries provide much more for building that sort of framework.”
Comment from 23 Apr 2026 in “OpenAI's response to the Axios developer tool compromise” - Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan”
Better ergonomics than fetch
“They do the same thing, except axios does it a little better, when it doesn't pwn you.”
Comment from 23 Apr 2026 in “OpenAI's response to the Axios developer tool compromise” “axios definitely has better ergonomics than fetch, especially for calling APIs.”
Comment from 23 Apr 2026 in “OpenAI's response to the Axios developer tool compromise” “Axios offers a lot over fetch for all but the simplest use cases”
Comment from 23 Apr 2026 in “OpenAI's response to the Axios developer tool compromise” - Comment from 23 Apr 2026 in “OpenAI's response to the Axios developer tool compromise”
Long-standing, reliable and well regarded
“Axios has been one of my favorite libraries for over a decade.”
Comment from 2 Apr 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” “Axios... just works. No need to reinvent anything”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” “Axios has a good reputation.”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan”
What people warn about
Each mark is one comment
Native fetch makes it unnecessary
“Most of axios' functionality has effectively been promoted to a language feature as `fetch`, but the problem is people don't bother to migrate.”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” “axios-like packages don't make sense to use any more in a world where AI+vanilla accomplishes the same thing”
Comment from 22 May 2026 in “Yt-dlp – [Announcement] Bun support is now limited and deprecated” “axios is not really needed now given that fetch is part of the JS std lib”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” - Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan”
- Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan”
- Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan”
Supply chain compromise via malicious versions
“If you ever did a npm install on a project using one of the affected axios versions, your entire system may be compromised.”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” “We have seen it happen with Axios which is one of the biggest supply chain attacks on the Javascript / Typescript ecosystem”
Comment from 23 Apr 2026 in “Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain” “Axios was just compromised on npm with malicious versions dropping a remote access trojan”
Comment from 1 Apr 2026 in “Claude Code's source code has been leaked via a map file in their NPM registry” - Comment from 23 Apr 2026 in “OpenAI's response to the Axios developer tool compromise”
- Comment from 3 Apr 2026 in “Post Mortem: axios NPM supply chain compromise”
Breaking changes and surprising behavior
“Libraries that automatically throw errors for status codes in the 400 and 500 ranges are pretty obnoxious”
Comment from 10 May 2026 in “I Will Not Add Query Strings to Your URLs” “I lost respect for Axios when they made a breaking change in a patch release.”
Comment from 31 Mar 2026 in “Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan” “Axios tries to adapt itself to fetch, which doesn't always work well.”
Comment from 31 Mar 2026 in “Prerelease of Ky 2.0” Security vulnerabilities and CVE warnings
“Any Node.js service that forwards user-controlled JSON through axios can be crashed with a single request.”
Comment from 27 Mar 2026 in “Taking Down the Internet's Most Popular HTTP Client with a Single JSON Key” “I think I had around 800 CVE warnings in relations to Axios in side a Microsoft tool”
Comment from 9 Oct 2026 in “Cloudflare acquires Deno”
Other HTTP client libraries people recommend
The four most recommended other HTTP client libraries, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Requests (Python library) | 23 | 7 | 77% | 8 | — | Approved |
| AxiosThis page | 21 | 37 | 36% | 5 | — | — |
| Go net/http | 12 | 7 | 63% | 4 | — | — |
| libcurl | 10 | 2 | 83% | 7 | — | Approved |
| httpx | 10 | 22 | 31% | 4 | — | — |
What people said
40 of the 64 comments that mention it, newest first. Each links to the original comment.
“I think I had around 800 CVE warnings in relations to Axios in side a Microsoft tool”
“Axios and financial and political decisionmakers”
“it's the laziest of lazy "journalism" for lazy readers and lazy thinkers”
“we used axios, and using DI it's a drop in replacement”
“axios-like packages don't make sense to use any more in a world where AI+vanilla accomplishes the same thing”
“Libraries that automatically throw errors for status codes in the 400 and 500 ranges are pretty obnoxious”
“wouldn't habe been hit by the axios vuln”
“We have seen it happen with Axios which is one of the biggest supply chain attacks on the Javascript / Typescript ecosystem”
“Taking on a supply chain risk in exchange for reducing developer friction is not worth it”
“Because your fetch most likely mishandle errors, lack retries, fail on redirects and is unnecessary verbose for both people and agents.”
“axios is probably better for that”
“People dissing axios probably suffer from other NIH problems too.”
“Missing a lot of event hooks that axios/ky give you.”
“Axios is something where you get most of that work done for you by the community for free”
“Or you can just use axios and an interceptor. Clean, elegant.”
“They do the same thing, except axios does it a little better, when it doesn't pwn you.”
“Axios offers a lot over fetch for all but the simplest use cases”
“Axios and other libraries provide much more for building that sort of framework.”
“axios definitely has better ergonomics than fetch, especially for calling APIs.”
“Axios handles errors better, has interceptors, parses JSON for you”
“The issue isn't the library itself, but rather the fact that it's popular and provided a large enough attack surface.”
“I can not find a single signed recent commit on the axios repo. It is totally yolo mode.”
“Axios has been one of my favorite libraries for over a decade.”
“Every team I've seen write a fetch wrapper eventually reimplements half of axios, just worse.”
“Axios was just compromised on npm with malicious versions dropping a remote access trojan”
“Axios tries to adapt itself to fetch, which doesn't always work well.”
“Axios has a good reputation.”
“You don't need it, and for special things like retries I could roll my own just fine.”
“I personally had to delete axios a couple of time from my codebase when working with junior devs.”
“Node has no need for Axios, native fetch support has been there for years”
“axios is not really needed now given that fetch is part of the JS std lib”
“Most of axios' functionality has effectively been promoted to a language feature as `fetch`, but the problem is people don't bother to migrate.”
“If you ever did a npm install on a project using one of the affected axios versions, your entire system may be compromised.”
“Convenience is a thing, but it doesn't require a massive library.”
“I lost respect for Axios when they made a breaking change in a patch release.”
“Axios... just works. No need to reinvent anything”
“It also supports proxies which is important to some corporate back-end scenarios”
“Also it has interceptors, which allow you to build easily reusable pieces of code”
“Any Node.js service that forwards user-controlled JSON through axios can be crashed with a single request.”
“Axios is a super prestigious political news site, they dont use AI.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.