StrangerDanger: Finding Security Vulnerabilities Before They Find You!

on YouTube ↗24m

" summary

A small demo app called Goof sample app uses real vulnerable NPM modules and shows concrete exploits: marked XSS via sanitization bypass, dust.js remote code execution by injecting evaluated template expressions, plus references to yarn MITM and the event-stream supply‑chain compromise. Data points include “61% packages considered abandoned” and an average of four nested packages per install with 78% of vulnerabilities in transitive deps. Scanning with Snyk finds issues, automated PR fixes and CI blocking are shown as practical mitigations.

AI-written summary · about

" chapters (5)

1. 0:00Open-source security risks
2. 7:28Security vulnerability demo
3. 19:03Why vulnerabilities spread
4. 21:28Fixing vulnerabilities challenges
5. 23:34Responsible open-source use

" related talks

• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 27mStrangerDanger: Finding Security Vulnerabilities Before They Find YouLiran Tal · ReactiveConf 2019
• 14mStranger Danger: Tracking Vulnerabilities in Your Third Party CodeGuy Podjarny, Assaf Hefetzz · Velocity Conference Amsterdam 2015
• 34mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Voxxed Days Frontend Bucharest 2019
• 37mStranger Danger: Finding Security Vulnerabilities Before They Find You!Liran Tal · Node.js Global Summit 2020
• 40mSecuring your dependenciesNina Juliadotter · NDC Sydney 2018
• 32mWriting Secure JavaScript CodeGuy Podjarny · View Source 2017
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022