How npm is Making JavaScript Safe For Everyone
summary
npm hosts over a million packages and grows ~40% yearly, supplying roughly 97% of web app JavaScript and over a billion downloads a month, so transitive dependencies and registry trust are real risks. Specific defenses include the built-in npm audit / npm audit fix for automated remediation and a forthcoming security insights API that returns publication metadata (publisher, publish endpoint, 2FA), malware indicators, and package behavior like postinstall phone‑home scripts.
AI-written summary · about
chapters (18)
- 0:00Start
- 0:20The Npm Registry
- 0:46About Me
- 2:31Why Open Source Is Successful
- 3:26The Software Supply Chain
- 4:04Packaging
- 8:24Code Drift
- 10:34Dedicated Security Teams
- 12:49Shifting Left
- 13:54Embed Security People in Your Development Teams
- 14:59Automation
- 15:58Machine Learning
- 16:48Npm Audit
- 18:51Publication Info
- 20:22Insight into Malware
- 21:03Package Behavior
- 24:47Why Open Source Is Valuable
- 25:27Contrast between Old Security and New Security
related talks
20mBuilding a Threat Model & How npm Fits Into It
42mSecuring Your Software Supply Chain
41mMalicious Modules on npm - a series of unfortunate events
41mThe Future of JavaScript Package Management
29mAll your packages are belong to us - Protecting your npm dependencies
41mnpm and the Future of JavaScript
47mBlack Clouds and Silver Linings in Node.js Security
41mnpm and the Future of JavaScript