The Good, the Bad and NPX
summary
Analyzes npm ecosystem collisions where many unrelated packages export the same CLI names by downloading 100+ GB of registry data and parsing about 2+ million packages. Runs reproducible experiments in GitHub Actions across npm, yarn, and pnpm to show divergent install/run behavior (including cases where a maliciously named binary wins), gives concrete counts (e.g., 45 packages exposing "node" and 33 exposing "npm"), demonstrates environment-injection proofs-of-concept, and presents a partial mitigation using npm exec / npx --package plus --ignore-scripts that is effective but awkward and conditional.
AI-written summary · about
chapters (13)
- 0:00Welcome
- 1:45Speaker intro
- 3:11Dependency cleanup history
- 6:02Duplicate binaries in registry
- 7:51Binaries in packages
- 12:31Hypotheses and experiments
- 15:47Package manager experiments
- 20:32Global registry analysis
- 24:31Popular commands and binaries
- 27:51Security and code injection
- 28:56NPX solution and limits
- 33:54Binary vulnerabilities and threats
- 35:23Q&A
related talks
42mPACKAGES FOR MASS CONSUMPTION - AN NPM STORY UNFOLDED
41mThe Future of JavaScript Package Management
45mNext Gen Package Management
29mAll your packages are belong to us - Protecting your npm dependencies
23mCover Your Apps While Still Using npm
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
19mNavigating JavaScript Userland
26mHow npm is Making JavaScript Safe For Everyone