Best Practices for Developers to Master Security
summary
Focuses on JavaScript/npm supply‑chain attacks with concrete examples: the user‑agent‑parser compromise, mass malicious publishes (about 500 packages over two months), and dependency confusion that lets public packages replace private ones. Shows attacker methods—postinstall scripts, repacked packages, typo/brand‑jacking—and mitigation steps: run SAST and SCA, use npm audit/defend, cache or freeze installs, use Docker, block installs for packages <7 days, inspect diffs between versions, and note detection/removal timelines (often detected in ~20 minutes and removed in 2–5 days).
AI-written summary · about
chapters (8)
- 0:00Start
- 3:08Disclaimers
- 10:35Brand Jacking
- 14:12Dependency Confusion
- 17:55Copycats
- 22:00Difference between Soft Supply Chain Security and Open Source Supply Chain Security
- 41:51Containers
- 43:25Summary
related talks
45mSecurity When Working with npm: Threats, Cases and Stories
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
15m“Security” in the JavaScript ecosystem
58mPractical Secure Development and Operations with JavaScript in 2020
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
42mSecuring Your Software Supply Chain