Cover Your Apps While Still Using npm
summary
Left-pad and pinkie-promise failures are concrete examples of single-module outages breaking builds; npm now hosts ~800,000 packages and sees billions of downloads per month. Practical defenses are: run a fallback registry mirror such as npmjs.cf or CNPMJS, maintain a private cache with Verdaccio, NPME or Artifactory, and consume multiple vulnerability sources (Snyk, Node Security WG, npm) since counts differ by hundreds. NodeSource ships an NCM desktop beta that maps dependency chains and reduced one demo app’s vulnerabilities from 42 to 29 by upgrading tap to 12.0.1.
AI-written summary · about
chapters (4)
- 0:00Start
- 8:29What can you to to cover your apps?
- 9:18Set up a Registry Mirror as a Fallback
- 13:43Security Vulnerability Sources
related talks
45mNext Gen Package Management
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
37mNode.js Package Maintenance...
42mThe Good, the Bad and NPX
16mAre we Forever Doomed to Software Supply Chain Security?
17mKeynote: The State of npm
30mHappy Developers, Healthy Modules - Together We Can Do This
27mnpm i g @next and beyond: Building the future of package management