Security When Working with npm: Threats, Cases and Stories
summary
Covers npm supply-chain threats facing frontend developers — specifically typosquatting, package substitution, malicious packages spread via job postings, and attackers gaining access to popular package development. Describes real incidents where updates broke major projects, adding a package leaked crypto-wallet credentials, and installing test-task projects granted remote access; then outlines methodologies and concrete defenses against these attacks and finishes with a practical npm safety checklist.
AI-written summary · about
chapters (10)
- 0:00npm security intro
- 1:24Threats in npm repo
- 5:14Typosquatting fake packages
- 10:11Detecting fake packages
- 15:35Attacks on private npm
- 18:02Social engineering interviews
- 20:49Malicious updates in packages
- 26:02Vulnerability protection tools
- 32:05npm security tips
- 37:40Q&A
related talks
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
52mBest Practices for Developers to Master Security
23mProtecting Your npm Dependencies
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
42mSecuring Your Software Supply Chain
41mMalicious Modules on npm - a series of unfortunate events
29mAll your packages are belong to us - Protecting your npm dependencies
47mBlack Clouds and Silver Linings in Node.js Security