Know Your JS: SBOMs for Frontend Devs
summary
Shows how to generate a real SBOM for a JavaScript project, using sift (or npm ls --all) to dump full direct and transitive dependencies, pretty‑print with jq, and scan the SBOM for CVEs with gripe or services like Sneak. Demonstrates SPDX vs CycloneDX output, GitHub Actions to regen SBOMs on push, and concrete attacks (typo‑squatting, the Glue Stack backdoor) that SBOMs expose so teams can patch and prove compliance.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:43JavaScript SBOM basics
- 4:11Direct vs transitive deps
- 7:40Software Bill of Materials
- 9:03SBOMs for security
- 11:30Typo squatting risks
- 15:00Generate SBOM with sift
- 17:31Scan SBOM for vulnerabilities
- 18:55Key takeaways
related talks
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
46mSBOMs Are Not Enough
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
34mSo, SBOMs Matter…Now What?
47mHands-On SBOM
29mMaking Software Bill of Materials (SBOMs) Actionable
34mSBOMs: zero to hero in 25 mins!