JavaScript and npm and what now
summary
NPM Inc is a VC-funded company that can plausibly stop serving millions of packages overnight, with a concrete incident where an added dependency contained malicious code targeting a specific Bitcoin ledger and a reported staff reduction of five people let go just before vesting plus alleged gag orders. The platform shows operational fragility: a new CEO installed last summer, visible layoffs and opaque governance, so the dependency graph can break because ownership and incentives change, not because of the code.
AI-written summary · about
related talks
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
23mProtecting Your npm Dependencies
38mThe economics of open source
41mMalicious Modules on npm - a series of unfortunate events
26mHow npm is Making JavaScript Safe For Everyone
20mBuilding a Threat Model & How npm Fits Into It
29mAll your packages are belong to us - Protecting your npm dependencies
47mBlack Clouds and Silver Linings in Node.js Security