All your packages are belong to us - Protecting your npm dependencies
summary
Examples of malicious npm packages inject code at build time, steal environment variables, and seed crypto‑thefts — one popular package reaches ~1M installs, another incident blocks about $13M in stolen crypto. Concrete defenses are shown: run npm audit, enforce lockfile pinning to freeze exact versions, and enable GitHub Dependabot or a continuous scanner so CI never silently pulls a new, trojaned release.
AI-written summary · about
chapters (7)
- 0:00Start
- 10:20STORY TIME
- 15:58CHECK OUT THE PACKAGE INFORMATION BEFORE INSTALLING
- 20:42ENSURE THAT YOU LOCK DOWN PACKAGE VERSIONS AND USE A PACKAGE-LOCK FILE
- 21:14TOOLS & WORKFLOWS
- 25:55CONCLUSION
- 26:42SHOULD WE START USING LOCK FILES?
related talks
23mProtecting Your npm Dependencies
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
41mMalicious Modules on npm - a series of unfortunate events
26mHow npm is Making JavaScript Safe For Everyone
20mBuilding a Threat Model & How npm Fits Into It
42mSecuring Your Software Supply Chain
47mBlack Clouds and Silver Linings in Node.js Security