npm vulnerabilities: the call is accepted
summary
Examines finding and mitigating npm package vulnerabilities by analyzing statistics to show why current problems were inevitable, and presents technical tools and policies for managing npm security. Covers practical measures and regulations the presenter uses to enforce npm policy, aimed at JS tech leads, InfoSec, and Dev(Sec)Ops.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:05Open source achievements
- 8:10Dependency vulnerabilities
- 13:04Vulnerability cataloging
- 20:33npm audit problems
- 28:54Project support gaps
- 31:44Private registry security
- 36:20Trusted author risks
- 40:54New package filtering
- 48:02Proxy registry solution
- 50:13Summary
related talks
26mHow npm is Making JavaScript Safe For Everyone
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
20mBuilding a Threat Model & How npm Fits Into It
45mSecurity When Working with npm: Threats, Cases and Stories
18mFramework for Frontend & Node.js Vulnerability Management
37mPackage Vulnerability Management & Reporting Collaboration Space for...
27mState of Node.js Security
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!