Keynote: Securing JavaScript
summary
npm faces account takeovers of high-impact modules like ua-parser-js, rc and co (downloads 7.5–13M weekly) that injected malware; initial response times drop from nine hours to 15 minutes after malware scanning, audited chatops removal, and a clear policy. High-impact packages are defined as >1M weekly downloads or >500 dependents. GitHub enforces mandatory 2FA in phases (top 100, top 500, then all high-impact), adds WebAuthn, a “limbo” publish-only state, automated account recovery, and resigns every package with ECDSA after OAuth token theft from Travis/Heroku exposed backups.
AI-written summary · about
chapters (11)
- 0:00Introduction and welcome
- 1:04npm and supply chain threats
- 2:28Account takeover attacks timeline
- 4:56Learning from attacks and response
- 6:21npm security roadmap goals
- 7:44Login verification rollout
- 9:09Mandatory 2FA enforcement
- 12:35Improving 2FA experience
- 15:01Account recovery improvements
- 16:47OAuth token breach response
- 19:15Future security investments
related talks
20mKeynote: Securing JavaScript
23mSecuring the npm Ecosystem
47mBlack Clouds and Silver Linings in Node.js Security
41mMalicious Modules on npm - a series of unfortunate events
31mKeynote: The State of JavaScript Supply Chain Security in 2022
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
52mBest Practices for Developers to Master Security