Node.js Security: Breaking The Loop
summary
Shows concrete attacks and fixes: npm packages with destructive install scripts and typosquatting, a malicious module exfiltrating environment variables, and a documented compromise of 14 packages representing ~20% of npm downloads. Demonstrates NoSQL injection via body-parser sending {$gt: ...} to MongoDB, catastrophic backtracking in regex blocking Node’s event loop, bypass of popular markdown parser marked, and practical fixes using content security policy, helmet, and the vulnerability scanner Snyk with CI integration.
AI-written summary · about
chapters (17)
- 0:00Start
- 0:45Node.js Security: Breaking The Loop
- 3:23The Magical 2010
- 4:00Node.js is JavaScript JavaScript is Everywhere
- 5:52validator.js helps validate and sanitize strings
- 16:28Securing Express
- 20:56noSQL Injections
- 25:46Validate Input Validata Length and Type
- 26:15Regular Expressions
- 32:44Regex DoS is a Real Problem
- 33:28DO NOT WRITE YOUR OWN REGEX
- 34:36Best Practice 4 safe-regex node.js module checks regex complexity backtracking vulnerably
- 35:23Secure Dependencies Management
- 36:20Who takes care of the risk for those packages?
- 39:55Are my dependencies vulnerable?
- 45:07check cve do for known Issues
- 45:31Security Ops Integrated Security into your build pipeline
related talks
55mNode.js Security: Breaking The Loop
56mNode.js Security
47mBlack Clouds and Silver Linings in Node.js Security
27mState of Node.js Security
24mWriting Secure JavaScript
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
29mA Node.js Security Roadmap
51mStranger Danger: Your Node.js Attack Surface Just Got Bigger