What's Really Going on Inside Your Node_Modules Folder
summary
Node ecosystem risk is concrete: installing one npm package typically pulls in 79 additional packages maintained by 39 maintainers, big apps like Discord rely on ~20,000 packages, and malicious packages often persist — a median of 209 days before public report. Examples include UA parser.js and typo‑squatting, many attacks use install scripts (≈94%). Practical defenses shown are automated package inspection (Socket), CI/GitHub integration that flags install scripts, native binaries, network calls and sudden maintainer changes before merge.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:40What is a software supply chain attack?
- 22:17Vulnerabilities vs. Supply chain Attacks
- 24:16Standard developer checklist
- 25:05Security-minded developer checklist
related talks
31mWhat's Going on Inside the Node_Modules Folder
41mMalicious Modules on npm - a series of unfortunate events
31mIt's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder, Feross Aboukhadijeh
18mNode.js Module: I Choose You!
47mBlack Clouds and Silver Linings in Node.js Security
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
42mSecuring Your Software Supply Chain
29mAll your packages are belong to us - Protecting your npm dependencies