npm Scripts and Security
summary
Explains how npm package management runs lifecycle scripts during actions like npm install and examines what those scripts can do. Covers the npm API surface (installation, publishing, scripts) and analyzes possible misuse or hijacking vectors in install-time script execution.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 3:34npm scripts execution
- 6:27Malicious script risks
- 8:55npm-controlled servers
- 10:02Hidden user addition
- 11:05Registry replication
- 13:13Preventing dangerous scripts
- 17:27npm audit limits
- 19:19Author verification issues
- 20:00User responsibility
- 21:48Typo squatting security
- 22:31Existing solutions limits
- 23:14Conclusion
- 23:58Q&A
related talks
26mHow npm is Making JavaScript Safe For Everyone
45mSecurity When Working with npm: Threats, Cases and Stories
53mnpm vulnerabilities: the call is accepted
52mBest Practices for Developers to Master Security
19mWhat You’re Really Trusting When You Run npm install
20mBuilding a Threat Model & How npm Fits Into It
17mA developer's take on security
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25