PACKAGES FOR MASS CONSUMPTION - AN NPM STORY UNFOLDED
summary
Shows concrete incidents and fixes: a maintainer unpublishes left-pad and breaks builds for minutes, attackers gain publish access to 14 modules covering ~20% monthly downloads, and a malicious change inside a checked-in lockfile can redirect installs. Demonstrates tools and controls that actually work: use npm ci / frozen-lockfile, enforce 2FA, run lockfile-lint, set npm ignore-scripts where needed, pin or shrinkwrap for consumers, use nvm for reproducible nodes, and run a local proxy like verdaccio local registry to survive outages and supply-chain twists such as lockfile tampering.
AI-written summary · about
chapters (6)
- 0:00Start
- 7:07Semantic Versioning
- 24:13Enterprise Readiness
- 28:37Takeaways
- 30:48Ignore Scripts
- 32:13Will Someone Compromise My Npm Account and Publish Malicious Code
related talks
41mMalicious Modules on npm - a series of unfortunate events
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
29mAll your packages are belong to us - Protecting your npm dependencies
47mBlack Clouds and Silver Linings in Node.js Security
23mProtecting Your npm Dependencies
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
45mSecurity When Working with npm: Threats, Cases and Stories