Sr. Content Developer at Microsoft, working remotely in PA, TechBash conference organizer, former Microsoft MVP, Husband, Dad and Geek.
152376 stories
·
33 followers

Why PDF Text Search Fails in JavaScript Viewers and How to Fix It

1 Share

Why PDF Text Search Fails in JavaScript Viewers and How to Fix It

TL;DR: PDF search fails in many JavaScript viewers because PDFs aren’t “real text files.” Font encoding quirks, missing text layers, image‑based scans, and inefficient rendering all sabotage accuracy. Syncfusion’s JavaScript PDF Viewer fixes this at the engine level, delivering reliable text extraction, precise highlighting, OCR-powered search, and fast navigation without third‑party libraries or hacks.

PDFs power the web until search stops working

PDFs run the modern web: contracts, invoices, manuals, reports, policies. But the moment users open a large PDF and hit Ctrl+F, things often fall apart.

Sound familiar?

  • Search skips obvious matches.
  • Highlights appear in the wrong place.
  • Navigation jumps unpredictably.
  • Large PDFs freeze the UI.

For end users, that’s frustrating. For developers, it’s worse; it makes your app feel unreliable.

The catch? PDF search is harder than it looks. Most JavaScript viewers fail not because of poor UI, but because they misunderstand how PDFs actually store text.

Let’s break down what goes wrong and how Syncfusion® JavaScript PDF Viewer fixes it with a powerful rendering engine and built-in search tools, no need for third-party libraries or extra setup.

Experience a leap in PDF technology with Syncfusion's PDF Library, shaping the future of digital document processing.

Why PDF text search fails in JavaScript Viewers

Text search is one of the most essential features in any PDF viewer, especially when dealing with large or complex documents. But in many JavaScript-based PDF viewers, search functionality often falls short, delivering missed results, inaccurate highlights, or poor navigation. These issues stem from the hidden complexities of how PDFs are structured and rendered in the browser.

PDFs aren’t structured like HTML or Word documents. What looks like readable text is often split into fragments, encoded strangely, or not text at all.

Let’s break down the key reasons why PDF search fails in JavaScript viewers:

  • Font encoding issues: Some PDFs use custom fonts or glyphs that obscure the actual character data. This makes it difficult for the viewer to correctly identify and match characters, resulting in missed or incorrect search results.
  • Rendering-based extraction: Certain viewers rely on visual rendering to extract text from the PDF. Instead of accessing the raw text layer, they attempt to capture text after the page is drawn. This approach can lead to incomplete or inaccurate search data.
  • Poor navigation between matches: Even when matches are found, users often struggle to move between them. In long or complex documents, a lack of intuitive navigation can make it hard to track your position or jump to the next result efficiently.
  • Lack of OCR support: Scanned PDFs are essentially images. Without Optical Character Recognition (OCR), the viewer cannot convert image-based text into searchable content. This limitation often forces developers to rely on third-party OCR solutions, adding complexity and cost.
  • Text layer issues: Many PDFs contain flattened content or embedded images instead of selectable text. If the document lacks a proper text layer, search functionality becomes impossible, no matter how advanced the viewer is.

In short, most JavaScript viewers treat search as a feature, Syncfusion treats it as core infrastructure.

How Syncfusion JavaScript PDF Viewer solves search problems

Syncfusion’s JavaScript PDF Viewer makes searching through PDFs both easy and reliable. It delivers accurate text highlighting, smooth navigation between results, and compatibility with a wide range of document types, all without requiring third-party tools or complex setup.

Beyond basic search functionality, Syncfusion offers a rich set of built-in features like case-sensitive search, multi-word search, and real-time search suggestions. These enhancements make the viewer adaptable to diverse user needs and elevate the overall search experience.

Watch how the feature works in action:

Fast, accurate search with highlights and navigation in JavaScript PDF Viewer
Fast, accurate search with highlights and navigation in JavaScript PDF Viewer

Below, you’ll find a range of search enhancements available in Syncfusion JavaScript PDF Viewer, each designed to make your text search more accurate, flexible, and user-friendly.

  • Accurate text highlighting: Syncfusion uses a powerful text extraction engine that accurately interprets embedded fonts and custom glyph mappings. This ensures that even PDFs with non-standard font encodings are searchable, and the correct text is highlighted. By reliably decoding character data, Syncfusion eliminates common search failures caused by font encoding issues.
  • Built-in search navigation: Easily move between search results using intuitive toolbar buttons or keyboard shortcuts. With “Search Next” and “Search Previous” options, users can quickly jump through matches, making document review faster and more efficient.
  • Search suggestions pop-up: A pop-up displays a list of relevant matches as the user types, allowing quick navigation to specific locations in the PDF. This enhances user experience by reducing manual scrolling and helping users find content faster and more efficiently.
  • Multi-word search support: Users can search for multiple keywords simultaneously, streamlining content discovery and ensuring no important information is missed, especially in lengthy or dense documents.
  • Optimized performance: Ensures that text search operations remain fast and responsive, even in large or multi-page PDF documents. Syncfusion achieves this through efficient rendering, smart indexing, and memory management. This results in a smooth user experience without lag, even when handling complex or high-volume content.
  • Support for complex and diverse PDF structures: The viewer reliably handles embedded fonts, irregular layouts, and structurally complex PDFs. It ensures consistent search results and accurate rendering across both standard and non-standard document formats.
  • Enable/disable text search: Using the enableTextSearch property during initialization to control whether users can search text within the PDF. This is useful for tailoring the viewer experience, especially when search functionality needs to be restricted or conditionally activated based on user roles or document types. Disabling search in large or image-heavy PDFs can reduce unnecessary processing and improve load times.

Try exploring the various text search modes in the Syncfusion PDF Viewer. Ranging from basic to advanced, each mode offers a unique way to find what you need.

For a deeper understanding of how everything works, check out the official guide and live demo. It is filled with insights to help you make the most of your viewer!

Explore the wide array of rich features in Syncfusion's PDF Library through step-by-step instructions and best practices.

Improve PDF search accuracy with Syncfusion JavaScript PDF Viewer: Best practices

Enhancing PDF search accuracy is essential for delivering a smooth and reliable user experience, especially in document-heavy apps. With Syncfusion JavaScript PDF Viewer, you can apply proven best practices to help users locate content more efficiently and interact with documents more intuitively.

Below are several techniques and use cases that can significantly enhance the accuracy and flexibility of text search in your PDF viewer:

Match case option for precise text search

When working with technical, legal, or academic documents, precision matters. Enabling the Match Case option ensures that search results only include text that matches the exact capitalization of the input. This reduces false positives and improves the relevance of results, especially in contexts where case sensitivity is critical.

Refer to the following image.

Enabling the match case search option in JavaScript PDF Viewer
Enabling the match case search option in JavaScript PDF Viewer

Broaden search scope with match any word

For users who may not know the exact phrase or want to find related content quickly, Match Any Word is a powerful feature. It breaks the input into individual words and searches for each separately, helping surface relevant results even from partial or incomplete queries. This improves accessibility and ensures important content isn’t missed due to phrasing differences.

Here’s what the output looks like:

Enabling the match any word option in JavaScript PDF Viewer
Enabling the match any word option in JavaScript PDF Viewer

Search multiple terms

Syncfusion’s JavaScript PDF Viewer allows users to search for multiple words or phrases in a single query, ideal for handling complex or detailed searches. You can configure the search to be case-sensitive based on user requirements, ensuring precision when needed.

Additionally, the search can be scoped to specific pages, avoiding unnecessary scanning of the entire document and improving performance. This flexibility makes it easier to deliver a tailored and efficient search experience.

Here’s a preview of the feature in action:

Multiple search terms in JavaScript PDF Viewer
Multiple search terms in JavaScript PDF Viewer

Enable text search in scanned PDFs with OCR

Scanned or flattened PDFs often contain image-based content, making traditional text search impossible. Syncfusion supports server-side Optical Character Recognition (OCR) to convert these images into searchable text. By specifying the OCR language during document loading, you can enable accurate search functionality in image-heavy documents.

Witness the advanced capabilities of Syncfusion's PDF Library with feature showcases.

Using asynchronous text search for flexible and responsive PDF searches

When users search through large PDF files or enter complex queries, the viewer can sometimes slow down or become unresponsive. To avoid this, Syncfusion JavaScript PDF Viewer offers an asynchronous text search feature that keeps everything running smoothly.

Instead of freezing the interface while searching, the viewer processes search results quietly in the background. This means users can continue reading, scrolling, or interacting with the document while the search is underway. It’s a great way to improve performance and deliver a better experience, especially in busy applications or when working with lengthy documents.

Frequently Asked Questions

Why does text search fail even when the PDF text looks selectable?

Font encoding and broken text layers cause failures, but the Syncfusion JavaScript PDF Viewer correctly interprets embedded fonts to return accurate matches.

Is it better to turn off text search for large or image-heavy PDF files?

Yes. Disabling enableTextSearch prevents text extraction and background search processing, which is useful for large, scanned, or image-heavy PDFs.

How does the viewer stay responsive during heavy searches?

Syncfusion provides an asynchronous search method (findTextAsync) that lets users continue interacting with the document while the search runs in the background.

Can the search experience be adjusted based on user needs?

Yes. You can control how search works by enabling options like case-sensitive search, matching any word, searching specific pages, or turning search on or off as needed.

Syncfusion’s high-performance PDF Library allows you to create PDF documents from scratch without Adobe dependencies.

Make PDF search feel effortless for users and developers

PDF text search shouldn’t feel unpredictable. Yet in many JavaScript apps, missed results, broken highlights, and slow performance are still the norm, not edge cases.

That’s exactly what Syncfusion’s JavaScript PDF Viewer is built to fix.

Why developers switch to Syncfusion

  • Accurate search results, even with embedded fonts and complex layouts.
  • Precise highlights that align with the actual text.
  • Smooth navigation across large, multi‑page PDFs.
  • Built‑in OCR for scanned and image‑based documents.
  • Fast, scalable performance without UI slowdowns.
  • No extra libraries or complex setup, it just works.

What you gain

  • Less time debugging PDF edge cases.
  • More control with flexible APIs and customizable UI.
  • A search experience users trust.
  • A solution that scales from quick prototypes to enterprise apps.

The latest version is available for existing customers to download from the license and downloads page. If you are not a Syncfusion customer, you can explore all the newest features with a 30-day free trial.

Need help? Visit the support forumssupport portal, or feedback portal. The Syncfusion team is ready to assist you!

Thanks for reading!

Read the whole story
alvinashcraft
just a second ago
reply
Pennsylvania, USA
Share this story
Delete

Formula‑Heavy Sheets Freezing the Browser? Fix It with Manual Calculation Mode

1 Share

Formula‑Heavy Sheets Freezing the Browser Fix It with Manual Calculation Mode

TL;DR: Formula-heavy web spreadsheets can trigger large dependency recalculation chains on each cell edit, which competes with rendering and input handling on the browser main thread. This article discusses automatic vs manual calculation mode, when recalculation runs, workbook vs sheet scope, and programmatic recalculation triggers in a React spreadsheet component.

You type in one cell, and the whole spreadsheet locks up.

If you’re building a browser-based spreadsheet, you’ve probably hit this wall: a small edit triggers a large chain of dependent formulas, and the recalculation work blocks the UI thread. The result is brutal for users: input lag, cursor delay, and a tab that “feels broken.”

The most reliable fix isn’t to optimize the formulas. It’s changing when formulas recalculate.

In the Syncfusion® React Spreadsheet Editor, you can prevent those freezes by switching to Manual Calculation Mode, so formulas update only when you explicitly recalculate, rather than on every keystroke.

This post covers:

  • Why formula-heavy sheets freeze in the browser?
  • When Manual vs. Automatic calculation makes sense.
  • How to enable Manual Calculation Mode in Syncfusion React Spreadsheet Editor?
  • A practical workflow: Smooth editing + deliberate recalculation + optional switch back to automatic.

Why formula-heavy spreadsheets freeze the browser

In Automatic calculation mode, every cell edit triggers recalculation for any dependent formulas. In a workbook with deep dependencies, that can mean thousands of recalculations from a single change.

In a browser, that calculation typically runs on the main thread, the same thread responsible for:

  • Rendering
  • Handling typing and pointer events
  • Updating the DOM

So, while recalculation is happening, your UI can’t keep up. Developers see:

  • Typing that stutters (events queue up)
  • Delayed selection/cursor movement
  • “frozen” tabs during data entry or bulk updates

This isn’t so much a data problem as it is a timing problem: you’re recalculating at the worst possible time during interaction.

Manual calculation mode: What it changes (and why it works)

Manual calculation mode stops formulas from recalculating automatically on every edit. The Syncfusion React Spreadsheet Editor provides the calculationMode property to control when formulas recalculate.

It enables:

  • Smooth editing: No background processing runs on every keystroke.
  • A fully responsive UI: regardless of formula complexity or workbook size.
  • User-controlled recalculation: Re-calculation runs only when explicitly triggered.

Manual mode may show stale values until recalculation is triggered, an intentional trade‑off for performance. By running formulas only on demand, it keeps large, formula‑heavy sheets fast and responsive while ensuring accurate results when needed.

Enabling manual calculation mode in Syncfusion React Spreadsheet Editor

Setting up Manual Calculation Mode takes a few lines of code:

Step 1: Set up your React project (using Vite)

You can create a new React app quickly using Vite:

npm create vite@latest my-app -- --template react
cd my-app
npm run dev

Step 2: Install the Syncfusion Spreadsheet package

All Syncfusion Essential Studio React components are available on npm. Install the Spreadsheet package:

npm install @syncfusion/ej2-react-spreadsheet

Step 3:Add required CSS files

Add the Syncfusion component styles in src/App.css:

@import '../node_modules/@syncfusion/ej2-base/styles/material.css';
@import '../node_modules/@syncfusion/ej2-inputs/styles/material.css';
@import '../node_modules/@syncfusion/ej2-buttons/styles/material.css';
@import '../node_modules/@syncfusion/ej2-splitbuttons/styles/material.css';
@import '../node_modules/@syncfusion/ej2-lists/styles/material.css';
@import '../node_modules/@syncfusion/ej2-navigations/styles/material.css';
@import '../node_modules/@syncfusion/ej2-popups/styles/material.css';
@import '../node_modules/@syncfusion/ej2-dropdowns/styles/material.css';
@import '../node_modules/@syncfusion/ej2-grids/styles/material.css';
@import '../node_modules/@syncfusion/ej2-react-spreadsheet/styles/material.css';

Step 4: Add the Spreadsheet component and enable manual mode

You need to set calculationMode='Manual' on the SpreadsheetComponent to control all formula recalculation behavior.

Here’s a code example of enabling Manual Mode in React:

import * as React from 'react';
import { createRoot } from 'react-dom/client';
import {
    SpreadsheetComponent,
    SheetsDirective,
    SheetDirective,
    RangesDirective
} from '@syncfusion/ej2-react-spreadsheet';
import {
    RangeDirective,
    ColumnsDirective,
    ColumnDirective
} from '@syncfusion/ej2-react-spreadsheet';
import { data } from './datasource';

function App() {
    const spreadsheetRef = React.useRef(null);
    React.useEffect(() => {
        let spreadsheet = spreadsheetRef.current;
        if (spreadsheet) {
            spreadsheet.cellFormat({ fontWeight: 'bold', textAlign: 'center' }, 'A1:H1');
        }
    }, []);

    return (
        <div>
            // Spreadsheet Component with Manual Calculation Mode enabled
            <SpreadsheetComponent id='spreadsheet' ref={spreadsheetRef} calculationMode={'Manual'}>
                <SheetsDirective>
                    <SheetDirective name={"Product Details"}>
                        <RangesDirective>
                            <RangeDirective dataSource={data} startCell={"A1"}></RangeDirective>
                        </RangesDirective>
                        <ColumnsDirective>
                            <ColumnDirective width={130}></ColumnDirective>
                            <ColumnDirective width={92}></ColumnDirective>
                            <ColumnDirective width={96}></ColumnDirective>
                        </ColumnsDirective>
                    </SheetDirective>
                </SheetsDirective>
            </SpreadsheetComponent>
        </div>
    );
};
export default App;

const root = createRoot(document.getElementById('root'));
root.render(<App />);

Step 5: Use the built-in recalculation options

Once Manual Mode is active, users can refresh formulas through:

  • Calculate sheet updates only the active sheet.
  • Calculate workbook updates all sheets in the workbook.

Here’s a quick demo of how the manual calculation mode works in the Spreadsheet:

Manual recalculation in React Spreadsheet
Manual recalculation in React Spreadsheet

If your application needs custom workflow controls, you can also trigger recalculation programmatically using the calculateNow method.

For example, recalculate the entire workbook using calculateNow method:

// Spreadsheet with Manual Calculation Mode enabled
<SpreadsheetComponent
    ref={spreadsheetRef}
    calculationMode="Manual"
>
</SpreadsheetComponent>

// Trigger workbook recalculation
const recalcWorkbook = () => {
    spreadsheetRef.current?.calculateNow('Workbook');
};

Automatic vs. Manual calculation mode: When to use each

  • Use Automatic when users truly need live-updating formulas in small spreadsheets (< 500 rows) and real-time dashboards.
  • Use Manual when you care about responsiveness during heavy interaction:
    • Large workbooks (1,000+ rows)
    • Complex interdependent formulas
    • Bulk data entry
    • Imports/pastes
  • Final result review or reporting

A common pattern is: Use Manual while editing or importing, and recalculate on demand. Optionally switch back to Automatic for review.

Next steps

  • Try Manual Calculation Mode in the Syncfusion React Spreadsheet Editor by setting calculationMode="Manual".
  • Add a Recalculate Workbook button (or use the built-in ribbon commands).
  • Test with your worst-case workbook and measure: input latency, time-to-interaction after edits, and overall perceived responsiveness.

Frequently Asked Questions

Will Manual Calculation Mode affect formula accuracy?

No. Manual Calculation Mode only changes when formulas recalculate, not how they are evaluated. All results remain accurate once recalculation is triggered.

Can users forget to recalculate and see outdated values?

Yes, temporarily. This is an expected trade‑off. Most applications mitigate this by providing clear recalculation actions (such as ribbon commands or buttons) or visual indicators showing that calculation is set to Manual.

Is Manual Calculation Mode suitable for all spreadsheet workflows?

Not always. Manual mode is ideal for large, formula‑heavy sheets, bulk imports, and performance‑critical editing. For small sheets or real‑time dashboards, Automatic mode may be more appropriate, and you can switch modes at runtime as needed.

Explore the endless possibilities with Syncfusion’s outstanding React UI components.

Conclusion

Thank you for reading! As spreadsheets grow, automatic recalculation becomes a bottleneck. Manual Calculation Mode in the Syncfusion React Spreadsheet Editor keeps editing fast by recalculating only when triggered, ensuring performance and reliability at scale.

Ready to deliver a freeze‑free spreadsheet experience? Try the Syncfusion React Spreadsheet Editor and see the difference.

If you’re a Syncfusion user, you can download the setup from the license and downloads page. Otherwise, you can download a free 30-day trial.

You can also contact us through our support forumsupport portal, or feedback portal for queries. We are always happy to assist you!

Read the whole story
alvinashcraft
just a second ago
reply
Pennsylvania, USA
Share this story
Delete

Cloud migrations: how to decide what to move first

1 Share

How do you decide what to move first in a cloud migration? Pat Wright outlines five practical guidelines to help you in this process. They cover risk, impact, testing, and business priorities.

“Someone has to go first”. Choosing which application is used as the ‘test subject’ (i.e, which ones is moved first), in a cloud migration, is an important and sometimes difficult decision to make. In this article, I’m sharing the guidelines I follow when I need to make this decision myself.

This will, of course, vary by company and its needs. I have run into situations where specific applications had to go first because they were critical and required cloud services or resources to function properly. Other times it’s been the newest application, simply because it’s the easiest to move. Regardless of the specific reason, make sure everything is discussed and agreed upon with key stakeholders beforehand.

The five key guidelines I follow when deciding what to move first in a cloud migration

  1. Write out a list of your applications and rate them by how easy to change they are (and how many resources you can use to change them). If you can easily change an application to work in the cloud, that suggests it can also adapt to changes in cloud infrastructure. Hence, it’s high on this list!

  2. Rate the list by “size” of application. If the application is down for X amount of time, how much will that impact your company? The impact it has is a good indicator of how low or high a priority it is when it comes to the cloud migration. I would suggest going with small applications first, since these are likely to have less of an impact.

  3. Determine the durability of your applications. Is the application always breaking? Is it always hitting alerts and causing problems? If so, it probably shouldn’t be moved first.

  4. Assess your company’s needs and objectives. Perhaps a customer requires cloud services, and you have to move for that reason? Perhaps application X will stop working if we don’t move it to the cloud? These are all determining factors in what should be migrated, when.

  5. How well can you test the application? If you have great test coverage for an application, that’s a good reason to put it high on the list. If you have low test coverage, you may run into issues, so an earlier migration wouldn’t be beneficial.

Ultimately, choosing the right application to move first is critical to a database migration. Make sure you review the list carefully, discuss with stakeholders, and come to an agreement as to what will work best in your company’s situation. 

Cloud adoption is accelerating, but database migrations aren’t keeping pace. Find out why.

The Cloud Migration Divide explores why complex, business-critical databases remain on-premises – and what’s holding organizations back as confidence fails to scale with complexity.
Download the free report

FAQs: How to decide what to move first in a cloud migration

1. Why is choosing the first application to move important in cloud migration?

It sets the stage for a smooth transition and helps identify potential issues early.

2. Should critical applications move first?

No, not always. Smaller, easier-to-migrate apps often make better initial candidates.

3. How do I decide which app to move first?

Consider ease of change, size, durability, business needs, and test coverage.

4. Who should be involved in this decision?

Key stakeholders from IT, operations, and business teams should agree on priorities.

The post Cloud migrations: how to decide what to move first appeared first on Simple Talk.

Read the whole story
alvinashcraft
15 seconds ago
reply
Pennsylvania, USA
Share this story
Delete

Axios npm Supply Chain Compromise – Guidance for Azure Pipelines Customers

1 Share

On March 31, 2026, malicious versions of the widely used JavaScript HTTP client library Axios were briefly published to the npm registry as part of a supply chain attack.

The affected versions — 1.14.1 and 0.30.4 — included a hidden malicious dependency that executed during installation and connected to attacker-controlled command-and-control (C2) infrastructure to retrieve a second-stage payload.

Because modern development workflows frequently rely on automated dependency resolution during CI/CD builds, environments such as developer workstations and build agents—including those used in Azure Pipelines—may have been exposed if they resolved the compromised versions during installation or update.

For a detailed technical analysis of the attack and recommended mitigations, please refer to the Microsoft Security Blog:

Mitigating the Axios npm Supply Chain Compromise on the Microsoft Security Blog.

Impact on Azure Pipelines

This incident does not represent a compromise of Azure Pipelines itself.

Customers who:

  • Use Microsoft-hosted agents, and
  • Run only Microsoft-authored built-in tasks

are not affected by any compromise of the Azure Pipelines platform or hosted agent infrastructure as a result of this npm ecosystem attack.

Azure Pipelines Microsoft-hosted agents execute jobs on Microsoft-managed virtual machines. Each pipeline job runs on a newly provisioned VM that is discarded after the job completes. Any changes made during a job are not persisted to subsequent jobs. See Microsoft-hosted agents for Azure Pipelines and Azure Pipelines agents on Microsoft Learn.

However, CI/CD pipelines execute customer-defined workflows, including installing third-party dependencies during build time. If a pipeline run installed one of the malicious Axios versions, code executed during package installation, and any credentials or secrets available to that affected job should be treated as potentially exposed.

If Your Pipelines Include Custom Scripts, Extensions, Self-Hosted Agents, or Containers, We Recommend the Following Actions

You may be at risk if your Azure Pipelines workflows include:

  • Custom pipeline scripts
  • Third-party extensions installed from the Marketplace
  • Self-hosted agents
  • Containerized build environments

Review Self-Hosted Agents

Self-hosted agents are customer-managed compute infrastructure used to run pipeline jobs. See Azure Pipelines agents on Microsoft Learn.

Self-hosted agents that executed pipeline builds during the compromise window may have:

  • Installed malicious dependencies
  • Persisted compromised packages in local caches
  • Exposed credentials accessible during pipeline execution

We recommend:

  • Reimaging or rebuilding affected agents
  • Reviewing agent activity logs during the relevant timeframe
  • Rotating credentials used by affected agents

Audit Third-Party or Custom Pipeline Tasks

Review whether any:

  • Marketplace extensions
  • Custom tasks
  • Inline scripts

used in your pipelines depend directly or transitively on Axios and executed npm install or update operations during pipeline execution.

Pipeline steps that resolve compromised dependencies may have access to:

  • Secure pipeline variables
  • Service connection tokens
  • Deployment credentials

Review Service Connections

Azure Pipelines uses service connections to authenticate pipelines to external or remote services such as:

  • Azure subscriptions
  • Container registries
  • Kubernetes clusters
  • External build or artifact systems (see Service connections on Microsoft Learn)

If compromised dependencies executed within a pipeline job, identities or credentials associated with service connections used during that run may have been exposed.

We recommend:

  • Rotating credentials associated with affected service connections
  • Reviewing actions taken by pipelines using those connections

Clear Pipeline Dependency Caches

Compromised dependencies may persist in:

  • Pipeline workspace caches
  • npm/yarn/pnpm cache directories
  • Container build layers
  • Generated artifacts
  • Package-manager caches

Clear dependency caches associated with affected repositories or agents to prevent reuse of compromised packages in future builds.

Artifacts generated from runs that installed the malicious package versions should be treated as untrusted and replaced with clean builds.

What to do now

Review any pipeline runs that may have installed the affected Axios versions, especially in workflows that use self-hosted agents, custom tasks, third-party extensions, or containerized build environments.

For detailed attack analysis, indicators of compromise, and mitigation guidance, see Mitigating the Axios npm Supply Chain Compromise on the Microsoft Security Blog.

What to review in your pipelines

  • Custom pipeline scripts
  • Third-party extensions installed from the Marketplace
  • Self-hosted agents
  • Containerized build environments

Best Practices to Reduce Future Supply Chain Risk in Azure Pipelines

Pin Dependency Versions

Avoid loose semantic version ranges such as:

"axios": "^1.13.0"

Loose constraints may automatically resolve to newly published versions during routine installs — including compromised ones.

Use Lockfiles and Deterministic Installs

Ensure your pipelines:

  • Commit package-lock.json / yarn.lock / pnpm-lock.yaml
  • Use deterministic install commands (e.g. npm ci)

This helps prevent unexpected dependency resolution during CI/CD runs.

Limit Secret Scope in Pipelines

Minimize exposure by:

  • Using least-privilege service connections
  • Injecting secrets only into steps that require them
  • Avoiding global environment variable exposure across jobs

Rebuild Build Outputs After Remediation

Do not assume that:

  • Container images
  • Deployment bundles
  • Published packages

produced during a compromised pipeline run are safe.

Rebuild affected outputs after remediating dependencies.

How to reduce future supply chain risk

  • Pin dependency versions
  • Use lockfiles and deterministic installs
  • Limit secret scope in pipelines
  • Rebuild build outputs after remediation

Learn More

To understand the attack mechanics, indicators of compromise, and Microsoft’s mitigation guidance, please review: Mitigating the Axios npm Supply Chain Compromise on the Microsoft Security Blog.

Self-hosted agents that executed pipeline builds during the relevant timeframe should be reviewed for signs that they installed the malicious package versions or the injected dependency plain-crypto-js@4.2.1.

We recommend:

  • Reviewing pipeline and agent logs for npm install or npm ci runs that resolved axios@1.14.1, axios@0.30.4, or plain-crypto-js@4.2.1
  • Reviewing network activity for connections to sfrclak[.]com or 142.11.206.73 on port 8000
  • Reimaging or rebuilding affected agents where practical
  • Rotating credentials that were available to affected runs

If an affected pipeline run had access to service connections or deployment credentials, those credentials should be treated as potentially exposed.

We recommend:

  • Rotating credentials associated with service connections used by affected runs
  • Reviewing service connection usage history and actions taken by those identities during the relevant timeframe

How to verify whether you were affected

Review pipeline logs for npm install or npm ci executions that resolved:

  • axios@1.14.1
  • axios@0.30.4
  • plain-crypto-js@4.2.1

Also review network and endpoint telemetry for the following indicators:

  • sfrclak[.]com
  • 142.11.206.73
  • hxxp://sfrclak[.]com:8000/6202033

The post Axios npm Supply Chain Compromise – Guidance for Azure Pipelines Customers appeared first on Azure DevOps Blog.

Read the whole story
alvinashcraft
55 seconds ago
reply
Pennsylvania, USA
Share this story
Delete

Take Control of AI Code Quality in CI: Live Demo

1 Share

AI is accelerating coding, but without the right checks, it can also introduce risk, inconsistency, and hidden issues into your codebase. Businesses are offering “total automation” and “AI-driven checks” while consumers lose control of code quality and security. 

In this livestream, we’ll show how to take control of AI-generated code by bringing deterministic, repeatable quality checks into your CI pipeline.

You’re invited!

Code quality livestream

Save Your Seat

Join JetBrains experts Kai (Product Specialist, Qodana), Alex (Solutions Engineer, Qodana), and Artem (Solutions Engineer, TeamCity) as they demonstrate how Qodana and TeamCity work together to:

  • Automatically analyze AI-generated code in CI.
  • Enforce consistent quality standards with deterministic inspections.
  • Reduce review bottlenecks and improve developer confidence.
  • Catch issues before they reach production.

We’ll also run a live demo, showing how AI-generated code flows through a CI pipeline and how Qodana applies reliable, repeatable checks to keep your codebase clean and maintainable.

Whether you’re experimenting with AI-assisted development or already using it in production, this session will help you build workflows that are both fast and trustworthy.

Your speakers

Kai Schmithuesen

Kai is an accomplished product specialist with over 15 years of experience in software sales, focusing on developer tools and practices. Originally from Germany, Kai spent over 17 years living and working abroad, working for international software companies before returning to Berlin.

Also from Qodana…

Alex Costa, Solutions Engineer at Qodana

Alex has spent over a decade helping teams implement modern code quality workflows, working closely with clients to provide live demos and building tailored proofs of concepts and custom solutions. Outside of work, he has a merry band of kids and enjoys crafting handmade dice – a creative outlet that reflects his attention to detail and love of building things from scratch.

From TeamCity…

Artem Rokhin, Solutions Engineer at TeamCity

Artem started out at JetBrains as a release manager over a decade ago and is now based in the Netherlands. As a certified JetBrains and TeamCity expert, he helps teams automate their CI/CD pipelines so every code change is built, tested, and validated before reaching production. He works closely with developer advocates and the developer community, putting his master’s degree in technology to good use.

Register Now!

Read the whole story
alvinashcraft
1 minute ago
reply
Pennsylvania, USA
Share this story
Delete

DeepSeek-V4: a million-token context that agents can actually use

1 Share
Read the whole story
alvinashcraft
1 minute ago
reply
Pennsylvania, USA
Share this story
Delete
Next Page of Stories