What's Going on Inside the Node_Modules Folder
summary
Examines real npm incidents: a ua-parser.js release with a Monero miner and password‑stealing DLL affects a package with 7 million weekly downloads and was live for compromised for four hours, builds show install scripts trigger on npm install, 56% of malware runs at install, malicious packages average 209 days online, research ingests 100 GB metadata + 15 TB tarballs. Offers a GitHub app and static analysis that flags privileged API use, typo‑squats and 70 static detections to block or warn before merging.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:05Speaker background
- 2:08ua-parser.js attack
- 6:22Supply chain acceleration
- 8:07node_modules complexity
- 10:36False security in tools
- 12:41Supply chain details
- 16:31Attack vectors
- 19:22Secure apps with open source
- 23:54Balancing updates
- 26:23Auditing dependencies
- 27:26GitHub security bot
- 30:14Call to action
related talks
31mIt's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder, Feross Aboukhadijeh
30mWhat's Really Going on Inside Your Node_Modules Folder
41mMalicious Modules on npm - a series of unfortunate events
47mBlack Clouds and Silver Linings in Node.js Security
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
23mProtecting Your npm Dependencies