What If Npm Install Could Say No? Real-Time Defense Against Malicious Packages
summary
Claim: a package manager can block malware at install time by running a threat-intel proxy for per-package verdicts, executing package scripts inside Landlock and Seatbelt sandboxes, and recording installs in an audit trail. An open-source agent called PMG proxies npm/pip, blocks known-bad packages, confines script access to project paths, and reports installs. Typical overhead is about 1–2s per package, sandboxing is opt-in, cache and Windows support are on the roadmap.
AI-written summary · about
chapters (10)
- 0:00Development machine compromises
- 1:25How npm install attacks work
- 3:09Gap in install-time defense
- 6:22Challenges in real-time protection
- 8:50Four defense layers
- 10:38Sandboxing malicious scripts
- 12:24Live npm install defense demo
- 13:25Limitations and roadmap
- 14:29Install-time security importance
- 15:36Q&A
related talks
29mAll your packages are belong to us - Protecting your npm dependencies
11mSilent Execution: Blocking Install-Time Supply Chain Attacks
09mLightning Talk: Enabling “Safe” Use of Untrusted Open Source Dependencies with Sandboxing
26mHow npm is Making JavaScript Safe For Everyone
20mBuilding a Threat Model & How npm Fits Into It
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
41mMalicious Modules on npm - a series of unfortunate events
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?