The node_modules Iceberg: Mysteries Below the Waterline
summary
Claims that 60.4% of incidents happen when patches exist but aren’t applied and that transitive dependencies hide most supply chain risk, illustrated by the tinycolor infection: 40+ npm packages, 2M weekly downloads. Shows how to enumerate dependencies with npm ls --all and surface vulnerabilities with npm audit and SBOMs. Describes a practical patch workflow using an ELS provider: add token to .npmrc, delete node_modules and cache, run npm install, and use overrides/resolutions to force patched packages.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 2:17Supply chain security
- 5:48React Native attack
- 7:58Transitive dependencies
- 10:47Node_modules iceberg
- 11:29What is an SBOM and why it matters
- 13:15Dependency counting
- 15:46Finding vulnerabilities
- 17:30Interpreting audit results
- 18:54Patching with overrides
- 20:41Security and accessibility
- 22:26Final thoughts
related talks
42mSecuring Your Software Supply Chain
23mProtecting Your npm Dependencies
30mWhat's Really Going on Inside Your Node_Modules Folder
47mBlack Clouds and Silver Linings in Node.js Security
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
40mDependency Management: The Cause of—and Solution to—All Supply...
42mSponsored Session: Dependencies: Do's and Don'ts
14mStranger Danger: Tracking Vulnerabilities in Your Third Party Code