Silent Execution: Blocking Install-Time Supply Chain Attacks
summary
Malicious backdoors hit npm packages react-native-country-select and react-native-international-phone-numbers and spread to 134,000 downloads by exploiting pre-install and postinstall scripts (Glassworm style), evading npm audit because the attack runs at install time and uses invisible unicode and trust flips. Practical defenses shown: pnpm ignores install scripts by default, npm install --ignore-scripts or npmrc settings, script blocking, and behavioral monitoring to harden local dev machines and CI/CD pipelines.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:03Supply chain attack case study
- 2:50npm lifecycle scripts
- 5:00Security and user experience
- 6:48Glassworm timeline and spread
- 7:30Why tools missed the attack
- 8:55Mitigation for install scripts
- 10:17Call to action
related talks
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
29mAll your packages are belong to us - Protecting your npm dependencies
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
23mProtecting Your npm Dependencies
41mMalicious Modules on npm - a series of unfortunate events
52mBest Practices for Developers to Master Security
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
20mWhat If Npm Install Could Say No? Real-Time Defense Against Malicious Packages