Who Watches the NPM Watchers?
summary
Research uses canary packages — NPM packages embedding Think Canary tokens (JavaScript payloads, EXEs, PDFs, .env and AWS credential decoys, images in READMEs) — to fingerprint who scans the registry and what they look for. Findings: AWS scans within 5 minutes and submits many finds to OSV; Microsoft/NPM performs minimal scanning; Chinese clouds (Alibaba, Tencent, ByteDance) mass-scan from many long-lived IPs; ReversingLabs hunts AWS creds and re-scans unchanged versions repeatedly; Kaspersky focuses on Word and Excel files and scans once per release.
AI-written summary · about
chapters (21)
- 0:00Introduction and speaker intro
- 1:01Who is Paul McCarthy
- 2:05NPM ecosystem overview
- 3:52NPM security flaws
- 5:56Global NPM mirror locations
- 6:40Research motivation for scanning NPM
- 7:24Canary packages concept
- 10:13Pew pew map and data capture
- 11:18NPM scanning by Microsoft
- 12:40Cloud providers scanning NPM
- 15:30Security vendors scanning patterns
- 17:17Kaspersky scanning focus
- 20:05China's mass NPM scanning
- 21:48Russia's NPM scanning activity
- 23:37Embedded credentials in NPM
- 25:23GitHub secret scanning failure
- 26:27Static vs dynamic analysis
- 27:49Key insights and takeaways
- 29:58Security implications and resource waste
- 30:19Related talks and resources
- 31:24Q&A session
related talks
35mSupply Chain Attacks: Focused on NPM attacks
20mBuilding a Threat Model & How npm Fits Into It
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
47mBlack Clouds and Silver Linings in Node.js Security
31mWhat's Going on Inside the Node_Modules Folder
29mAll your packages are belong to us - Protecting your npm dependencies