npm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
summary
An overview of large-scale npm registry growth and concrete supply-chain attacks: typosquatting that injected a token-grabber into a math library, a trojan Prettier plugin that auto-starts on Windows, impostor Chalk and double-squatting packages that read files, Faker.js and color.js releases that created infinite console loops breaking many sites, and an Everything package that floods installs. Presents defenses and tooling: AuditJS, npm provenance badges, using npm proxy/Nexus and npm Registry Firewall, and strategies like delaying updates to mitigate risk.
AI-written summary · about
chapters (7)
- 0:00npm security intro
- 3:54Typosquatting attacks
- 12:44Package substitution risks
- 14:48Fake interviews & malicious packages
- 16:33Broken packages protest
- 21:44Vulnerability protection tools
- 27:16Security takeaways
related talks
45mSecurity When Working with npm: Threats, Cases and Stories
47mNode.js Security: Breaking The Loop
52mBest Practices for Developers to Master Security
23mProtecting Your npm Dependencies
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
41mMalicious Modules on npm - a series of unfortunate events
47mBlack Clouds and Silver Linings in Node.js Security
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?