Securing the npm Ecosystem
Talkat Open Source in Finance Forum New York 2022 · on Thursday, 2022-12-08· at 15:15· HALL 1, New York, NY, USA·
summary
GitHub describes concrete fixes: after several high‑impact hijacks response time drops from nine hours to 15 minutes, login verification OTPs roll out and 2FA enforcement blocks new sessions for high‑impact maintainers only. Adoption reaches 88% of the top 500 and 91% of the top 100, 79% of high‑impact packages. New features launched include Granular access tokens (per package/scope/org, IP ranges, expirations) and free Code Explorer. A Sigstore provenance proposal targets Q1 2023 for keyless signing.
AI-written summary · about
chapters (23)
- 0:00Intro
- 1:17Acknowledgements
- 1:55Abigail introduction
- 3:00Agenda
- 3:48Why focus on security
- 4:23Open Source is built on trust
- 4:41GitHub is the stewards
- 4:55Npm is a critical tool
- 5:20Account Takeovers
- 6:37What we learned
- 7:35The plan
- 8:27Login verification
- 10:04Adoption update
- 10:50Improved 2FA experience
- 11:22Better 2FA management
- 11:51Better 2FA enforcement
- 12:19Improved account recovery
- 13:24New releases
- 14:11code explorer
- 14:50Sigstore
- 16:13Repository
- 17:11Wrap up
- 17:49Thank you
related talks
20mKeynote: Securing JavaScript
20mKeynote: Securing JavaScript
25mWhen the supply chain hits a sour note
16mAre we Forever Doomed to Software Supply Chain Security?
23mProtecting Your npm Dependencies
19mSecuring Packages in npm, Homebrew, PyPI, Maven Central, and...
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
20mBuilding a Threat Model & How npm Fits Into It