“Security” in the JavaScript ecosystem
summary
Examples: the event-stream exfiltration campaign shows a malicious maintainer takeover that injects code to steal wallet private keys; eslint-scope credential theft demonstrates compromised developer/CI accounts publishing trojaned releases; typosquatting and left-pad withdrawal break builds transitively; a registry compromise can push remote‑execution gems. Defenses are concrete: enforce strong passwords and two‑factor authentication, run npm audit and review dependency code and repos, require package signatures (PGP) and aim for reproducible builds to ensure published bundles match reviewed source.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:12Story
- 1:02The plan
- 2:32The maintainer
- 3:14Alex
- 4:26Package systems
- 4:45Attack factors
- 8:39How to defend
- 9:41Are you secure
- 10:32What are you running
- 12:11Did no one tamper
- 13:20Repreducibility
related talks
52mBest Practices for Developers to Master Security
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
25mSecurity First
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
58mPractical Secure Development and Operations with JavaScript in 2020
23mProtecting Your npm Dependencies
46mApplication security from start to finish
20mKeynote: Securing JavaScript