Building a Threat Model & How npm Fits Into It
summary
NPM runs a 10 million‑user registry with ~809,000 packages and over a billion downloads per day and finds compromised maintainer accounts cause the worst incidents so enforces two‑factor authentication (50% of downloads covered, 364% adoption increase) and blocks breached passwords. Known‑vulnerability data (16% of packages contain at least one issue) is built into the CLI via npm audit and npm audit fix. Automated runtime analysis flags network and filesystem behavior at publish time and package signing plus a report‑vulnerability feed help catch malware and insider tampering.
AI-written summary · about
chapters (7)
- 0:00Fun fact
- 4:30Threat Modeling
- 6:04What mitigations are missing or weak?
- 6:37Frameworks
- 9:19Compromised Accounts
- 10:31Known Vulnerabilities
- 15:19npm audit Find and fix vulnerabilities in your JavaScript applications
related talks
26mHow npm is Making JavaScript Safe For Everyone
41mMalicious Modules on npm - a series of unfortunate events
35mSupply Chain Attacks: Focused on NPM attacks
47mBlack Clouds and Silver Linings in Node.js Security
29mAll your packages are belong to us - Protecting your npm dependencies
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
31mWhat's Going on Inside the Node_Modules Folder