Black Clouds and Silver Linings in Node.js Security
summary
Survey of real incidents and demos shows npm hosts ~1M packages and 40B monthly downloads while malicious modules repeatedly appear: a rimraf-like package deletes disks on install, a typosquat cross-n vs cross- steals env vars, mailparser includes a backdoor with ~300k monthly downloads, and event-stream injects Bitcoin theft. Research finds 14% of packages have had publish access covering ~20% of downloads; 600 maintainers use “123456” and many reuse passwords. Live demos exploit execSync command injection, NoSQL injection via JSON objects, and ReDoS catastrophic backtracking that pins CPU at 100%. The Node.js Security Working Group and npm now add notifications, 2FA, responsible disclosure and scanning integrations.
AI-written summary · about
chapters (6)
- 0:00Start
- 10:36Dependency Management
- 14:52Command Injection
- 19:42noSQL Injections
- 37:05The npmjs Ecosystem
- 43:10Node.js Security Working Group
related talks
41mMalicious Modules on npm - a series of unfortunate events
31mWhat's Going on Inside the Node_Modules Folder
27mState of Node.js Security
47mNode.js Security: Breaking The Loop
20mBuilding a Threat Model & How npm Fits Into It
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
23mProtecting Your npm Dependencies
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream