Threat Modeling Node
summary
Claims Node has a real security gap and proposes a concrete mitigation: Node looks for a policy.json traversal up the cwd, starts in a restricted operating mode, computes an integrity hash of the dependency tree and enforces syscall entitlements from package.json. Prototype targets Linux using platform sandbox APIs, wraps filesystem and network calls, and aborts on violations. Cites low CSP adoption and recent malicious npm/electron packages as motivating evidence.
AI-written summary · about
chapters (5)
related talks
20mBuilding a Threat Model & How npm Fits Into It
49mThreat Modeling Toolkit
46mThreat modeling is on the rise
57mUnlocking Threat Modeling
31mThreat Modeling for Kubernetes: Enhancing Security Posture in Complex and Regulat...
48mImproving the Security of a Large Open Source Project One Step at a Time
18mFramework for Frontend & Node.js Vulnerability Management
38mThreat Modelling Kubernetes: A Lightspeed Introduction