What You’re Really Trusting When You Run npm install
summary
npm install resolves an ideal tree from package.json or package-lock and then downloads tarballs and runs lifecycle scripts; a bad publish minutes before install can run a postinstall hook and compromise a machine. Upgrade to npm 12 disables lifecycle scripts by default and use npm approve-scripts and the minimum release age (since npm 11.10) to block fresh malicious releases. On the publishing side use trusted publishing issues short-lived CI tokens and stage publishing so CI can’t push live packages without human approval.
AI-written summary · about
chapters (9)
- 0:00npm install security risks
- 1:33How npm install works
- 4:01Exploiting trust in dependencies
- 6:49Security for npm installers
- 11:03Protecting publishers
- 13:54Trusted vs stage publishing
- 16:02Future npm security
- 17:48What you trust with npm install
- 18:33npm security resources
related talks
35mnpm Scripts and Security
11mSilent Execution: Blocking Install-Time Supply Chain Attacks
42mPACKAGES FOR MASS CONSUMPTION - AN NPM STORY UNFOLDED
29mAll your packages are belong to us - Protecting your npm dependencies
26mHow npm is Making JavaScript Safe For Everyone
41mMalicious Modules on npm - a series of unfortunate events
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
22m#unpublish Happens — How to protect your Node.js Investment