Malicious Modules on npm - a series of unfortunate events
summary
NPM hosts ~1.2M packages and 70+ billion downloads a month; installing one package implicitly trusts ~79 transitive packages and ~39 maintainers, creating a large attack surface. Real incidents include typo-squatting packages that run postinstall scripts, the getcookies backdoor that executes JS received via HTTP headers, malicious modules that steal .npmrc tokens, and the event-stream compromise via social engineering. Research finds ~61% of packages inactive, ~14% of modules publishable via weak creds (covering ~20% of traffic). Use npm audit, lockfile policies and lockfile injection checks; 2FA adoption remains ~10–15%.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:17Black Clouds & Silver Linings in Node.js Security
- 4:08npm's Heavy reuse
- 5:22The Biggest Repository Invites big risks
- 16:15Reset the buffer
- 16:45Observation 1
- 18:17What's going on?
- 20:07Who depends on eslint-scope?
- 20:54Observation 2
- 26:51Observation 3
related talks
47mBlack Clouds and Silver Linings in Node.js Security
31mWhat's Going on Inside the Node_Modules Folder
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
20mBuilding a Threat Model & How npm Fits Into It
30mWhat's Really Going on Inside Your Node_Modules Folder
29mAll your packages are belong to us - Protecting your npm dependencies
26mHow npm is Making JavaScript Safe For Everyone
23mProtecting Your npm Dependencies