It's a Jungle Out There! – Open Source Supply Chain Attacks
summary
NPM packages run arbitrary code at install time and attackers hide payloads in preinstall scripts, with 64% of malicious packages executing on install. Examples include ua-parser-js pushing a Monero miner and credential-stealing DLL affecting Windows; that package has ~30 million monthly downloads. Wormhole/socket.dev scans the registry, shows file/network/install-script use, flags typosquatting and dependency-confusion, and reports 700 removed packages in the last 30 days, plus a GitHub app to block risky updates.
AI-written summary · about
chapters (11)
- 0:00Introduction and background
- 3:10Why supply chain attacks happen
- 7:42Vulnerabilities vs malware
- 10:10Malware in install scripts
- 15:40Typosquatting and dependency confusion
- 18:27Code mismatch between GitHub and NPM
- 19:50Scope of the problem
- 20:32Introducing the Socket tool
- 27:47GitHub app for real-time protection
- 28:29Q&A on tool usage and future plans
- 31:16Closing remarks and plug
related talks
31mIt's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder, Feross Aboukhadijeh
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
31mKeynote: The State of JavaScript Supply Chain Security in 2022
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
16mNation-State Threats in the Open-Source Software Supply Chain
31mWhat's Going on Inside the Node_Modules Folder
46mSponsored Session: Malicious Package Trends Compared With Malware Evolution
38mThe Risks of Blind Trust in Code from Strangers