Stranger Danger: Tracking Vulnerabilities in Your Third Party Code

on YouTube ↗14m

" summary

A live demo runs Snyk Stranger against a Node app (npm ~200,000 packages, 2.5B monthly downloads) and immediately reports five vulnerabilities; one outdated transitive dependency is exploitable and a prepared payload yields a reverse shell exploit on the demo machine. The tool offers guided upgrades, downstream patching from an open patch database, CI/test integration and dependency snapshots; research cited shows ~11% npm packages with known vulns and repair times measured in hundreds of days.

AI-written summary · about

" chapters (7)

1. 0:00Open source benefits
2. 0:22Security risks in open source
3. 1:26Third-party dependency risks
4. 3:49Introducing the Snyk tool
5. 5:08Live exploit demonstration
6. 8:23Fixing vulnerabilities
7. 11:00Best practices and conclusion

" related talks

• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 27mStrangerDanger: Finding Security Vulnerabilities Before They Find YouLiran Tal · ReactiveConf 2019
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 34mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Voxxed Days Frontend Bucharest 2019
• 10mGuy Podjarny, Snyk | Node Summit 2017Guy Podjarny · Node Summit 2017
• 40mSecuring your dependenciesNina Juliadotter · NDC Sydney 2018
• 37mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Node.js Global Summit 2020
• 47mBlack Clouds and Silver Linings in Node.js SecurityLiran Tal · Voxxed Days Zurich 2019