Node.js Module: I Choose You!
summary
600K modules exist and a single Twitter helper can pull in 49 modules, ~46k lines and six different licenses. Notable attacks include typo‑squatting (mr. bash) and malicious publishes that try to leak NPM tokens. Mitigations: use npm audit, GitHub security alerts and package-locks, run npx license-checker and prefer modules with steady commits, sensible semantic versions and good npm quality scores. IBM runs module insights that executes test suites across Node 6/8/10 and platforms (including Power) and reports pass/fail.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:45Nodejs Modules
- 2:09Security
- 3:13typosquatting
- 5:05Mitigation
- 6:24Distribution
- 8:53Questions to ask
- 10:59Breaking Changes
- 12:00Module Versions
- 14:19More to Insights
- 15:49Summary
related talks
30mWhat's Really Going on Inside Your Node_Modules Folder
41mMalicious Modules on npm - a series of unfortunate events
31mWhat's Going on Inside the Node_Modules Folder
02h 24mHow to Node.js - Part 2
47mBlack Clouds and Silver Linings in Node.js Security
16mEvery node.js module ever!
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
31mIt's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder, Feross Aboukhadijeh