What's in Your JS?

on YouTube ↗20m

" summary

Argues that the real question is what's actually in package.json not the topic, citing a real project with 300 packages and eight conflicting jQuery installs where the first-to-load wins caused subtle bugs. Shows concrete tooling: Jaeger tracing, Bluebird for richer promises, OWASP dependency-check and CVE alerts, plus profilers (commercial and open) to map call traces. Warns about typosquatting and planned a fake "flamingo" package demo that remains hypothetical rather than deployed.

AI-written summary · about

" chapters (7)

1. 0:00Start
2. 1:38Takeaways
3. 4:11Core Differences between the Java Ecosystem
4. 10:27Dependency Health
5. 15:19Other Tooling
6. 15:31Dependency Checker
7. 17:29Project Flamingo

" related talks

• 28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25Anastasiya Egorova · JS Conf Armenia 2025
• 53mArchitecting Robust JavaScript ApplicationsTom Van Cutsem · JSConf Belgium 2020
• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 21mKnow Your JS: SBOMs for Frontend DevsChris DeMars · Commit Your Code 2025
• 52mBest Practices for Developers to Master SecurityMaciej Mensfeld · Connect.Tech 2021
• 40mHostile JavaScript: Attacking and Defending the BrowserTodd H. Gardner · NDC London 2023
• 27mStrangerDanger: Finding Security Vulnerabilities Before They Find YouLiran Tal · ReactiveConf 2019
• 42mSecuring Your Software Supply ChainDarcy Clarke · OpenJS World 2023