It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder, Feross Aboukhadijeh
summary
Shows that ua-parser.js is compromised for four hours and that malicious packages sit live an average of 209 days, backed by a 100 GB metadata and 15 TB tarball npm crawl. Demonstrates common vectors — typo-squatting, dependency confusion, hijacked accounts — and tactics like preinstall scripts, obfuscation, network exfiltration and DLL password theft. Presents a built mitigation: Socket GitHub app with 70 detections across five categories that flags install scripts, privileged API use and suspicious updates and runs automatically in PRs.
AI-written summary · about
chapters (14)
- 0:00Supply chain risks in Node.js
- 1:27UA Parser.js supply chain attack
- 6:21Why supply chain attacks rise
- 7:46Complexity of Node_modules
- 9:09Why devs don’t review code
- 10:34Flaws in vulnerability scanning
- 12:20How supply chain attacks work
- 13:24Attack vectors in npm packages
- 16:34Malicious tactics in dependencies
- 19:04Secure apps with dependencies
- 23:39Balancing dependency updates
- 26:24Auditing dependencies
- 28:10Socket’s security bot
- 30:17Call to action
related talks
31mWhat's Going on Inside the Node_Modules Folder
30mWhat's Really Going on Inside Your Node_Modules Folder
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
47mBlack Clouds and Silver Linings in Node.js Security
47mNode.js Security: Breaking The Loop
41mMalicious Modules on npm - a series of unfortunate events
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream