Package Reputation Tracking
no recording on file
summary
Describes tools and processes for tracking reputation of npm packages by collecting signals like download counts, updates, forks, and changes to install scripts, and integrating those checks into CI/CD pipelines. Covers using those signals to flag suspect code changes, maintain white/blacklists, and streamline review of specific (package, version) tuples to avoid unmaintained or risky dependencies, with plans to release an open-source project for broader use.
AI-written summary Β· about
related talks
20mBuilding a Threat Model & How npm Fits Into It
35mSupply Chain Attacks: Focused on NPM attacks
39mnpm and Sigstore: Provenance Comes to the World's Largest OSS Ecosystem
27mBringing Provenance to All of Open Source: Lessons from Npmβs Sigstore Integration
34mPackage Quest, the journey of a package from the npm registry to your computer.
37mPackage Vulnerability Management & Reporting Collaboration Space for...
47mBlack Clouds and Silver Linings in Node.js Security
42mPACKAGES FOR MASS CONSUMPTION - AN NPM STORY UNFOLDED