Package Vulnerability Management & Reporting Collaboration Space for...
summary
The collaboration space launches a neutral forum to fix CVE workflows across npm, GitHub and consumers, backed by numbers: ~1.6M public packages, ~123 billion monthly downloads, ~683 average transitive dependencies, and >1,600 advisories in the npm DB; a 59% chance a project sees a CVE in a year. Practical outputs include the npm audit resolver tool and a CI-friendly ignore for 24 hours workflow, plus monthly GitHub meetings to standardize metadata, exploitability scores, and triage/shareable decision files.
AI-written summary · about
chapters (10)
- 0:00Introduction and speakers
- 0:22State of the JavaScript ecosystem
- 6:00Impact on end users and maintainers
- 8:30Security and productivity balance
- 10:58Tooling and culture of caring
- 13:48Building security awareness
- 16:23Context over control in security
- 20:17Why a collaboration space
- 22:43How to get involved
- 23:24Closing remarks and Q&A
related talks
53mnpm vulnerabilities: the call is accepted
20mBuilding a Threat Model & How npm Fits Into It
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
48mImproving the Security of a Large Open Source Project One Step...
35mSupply Chain Attacks: Focused on NPM attacks
40mDependency Management: The Cause of—and Solution to—All Supply...
27mPanel: Building A Secure Ecosystem for Node.js
45mNext Gen Package Management