Protecting Your npm Dependencies
summary
Timeline of real supply‑chain incidents, concrete impacts and fixes: a typo‑squatting package exfiltrates env tokens, event‑stream compromises a module with ~1M weekly downloads to steal Bitcoin, and an electron wrapper release triggers attempts to steal crypto later estimated at ~$13M intercepted. Practical defenses shown are NPM audit, scheduled repository scans like Snyk, and automated fixes via GitHub dependency alerts, plus deterministic builds using package lock files so installs always produce the exact audited code.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 4:57CrossArms
- 8:02Event Stream
- 10:57Electron Native Notification
- 13:30NPM Audit
- 19:32Conclusion
related talks
29mAll your packages are belong to us - Protecting your npm dependencies
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
45mSecurity When Working with npm: Threats, Cases and Stories
42mSecuring Your Software Supply Chain
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
47mBlack Clouds and Silver Linings in Node.js Security
41mMalicious Modules on npm - a series of unfortunate events
35mSupply Chain Attacks: Focused on NPM attacks